Add `chain_condition` attribute to `simple_iptables_rule`

Defining a `simple_iptables_rule` resource actually creates a new chain with the name of
the resource and a jump to the chain from the chain specified in the `direction` attribute.
By default, the jump is unconditional. Introduce a `chain_condition` attribute to be able
to make the jump conditional. For example:

    simple_iptables_rule "management_interface" do
      direction "INPUT"
      chain_condition "-i eth1"
      rule [ "-p tcp --dport 80", "-p tcp --dport 443" ]
      jump "ACCEPT"
    end

The rules specified under the `rule` attribute will only be evaluate for packets for which
the rule in `chain_condition` holds.