add ipset support

This adds support for ipset matching.

On a side note, the implementation of this was undesirable due to limitations in the firewall module. I wanted to be able to do:

```
firewall { '005 ipset blacklist':
  chain => 'INPUT',
  ipset => 'blacklist',
  ipset_match => ['src','dst'],
  action => 'drop',
}
```

but couldn't because the command line form is `--match-set blacklist src,dst`, and the firewall module does not support multi-argument parameters. So it had to be done as a single space-delimited option:

```
firewall { '005 ipset blacklist':
  chain => 'INPUT',
  ipset => 'blacklist src,dst',
  action => 'drop',
}
```