(MODULES-689) Add support for connlimit and connmark

This adds support for the use of connlimit and connmark
eg.
```
  firewall { '400 connlimit exceeded LOG':
    chain           => 'INPUT',
    proto           => 'tcp',
    dport           => '22',
    connlimit_above => '10',
    connlimit_mask  => '32',
    connmark        => '0x1',
    log_prefix      => '* connlimit exceeded *',
    jump            => 'LOG',
  }
```