nixos/nat: add forwardPorts for external->internal DNAT

Especially useful when you want to access services in containers from the outside directly without any proxy in the middle.
It might be a bit cleaner to have separate `destPort` and `destAddress` options.

Also, could you specify a type for the attributes so that users get proper error messages?