Remove iptables >1.4.11 specific functionality

Scientific Linux 6 (and likely other similar distributions such as CentOS 6) ship with iptables 1.4.7, which doesn't support the -C flag.

Looking at examples of how other systems are handling this, Saltstack actually parses the help document to figure out if "--check" is present, and then either uses it (if present), or does something similar to this patch (if absent): https://github.com/saltstack/salt/blob/d50fdcb456ab69407610c5fa2abab68605af8084/salt/modules/iptables.py#L462

@thockin This is a continuation of #1979, now with ~100% more actually working, less bash, and a bit more testability.

I'm getting the same results for the e2e tests for this and master (using vagrant to run it): basic.sh and guestbook.sh passing and the others failing.

Edit: After some confusion, it looks like I'm mistaken about this requiring a kernel upgrade. I've removed that sentence.
We have pkg/util/set.go which has StringSet.  Maybe you can check the prefix, check the number of args, split this into a StringSet, and add a StringSet.Equal() function.

You have to check the length before StringSet because some argument can come through in duplicate (eg -m tcp -p tcp => [-m, -p, tcp]).

Even this is not quite right, because some args, like ! change the meaning of a rule.

-A KUBE-PROXY ! -d 10.0.0.1/32 -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 34089

...is the same length and StringSet as...

-A KUBE-PROXY -d 10.0.0.1/32 -p tcp -m tcp ! --dport 34089 -j REDIRECT --to-ports 443

...but they mean very different things.