add ipset support

This is a rebased version of #348 and a fix for MODULES-1173.
Since this is possible to be inverted, do we want to add `(!\s+)?` and `"\1\2 \3"` to the regex, and add it to https://github.com/puppetlabs/puppetlabs-firewall/blob/master/lib/puppet/provider/firewall/iptables.rb#L318 ?