Add 'log' to the permissible targets of the nat table

otherwise rules that have log as a target will result in a broken iptables configuration.
In particular, instead of the rules appearing in /etc/sysconfig/iptables under

    :POSTROUTING ACCEPT

we get

    -N LOG

which is not correct, and iptables-restore complains that a chain must not have the same name as a target.

The fix is really simple, and runs in production at our site. So please apply this!