nixos/nat: add forwardPorts for external->internal DNAT

Especially useful when you want to access services in containers from the outside directly without any proxy in the middle.