firewall: add support for nat-rules and netifd-proto-originating rules

Signed-off-by: Steven Barth <steven@midlink.org>

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@40510 3c298f89-4303-0410-b956-a3cf2f4a3e73
ds-lite: disable NAT according to RFC 7084

Signed-off-by: Steven Barth <steven@midlink.org>

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@40511 3c298f89-4303-0410-b956-a3cf2f4a3e73