(MODULES-439) Work around existing rules

The firewall resource is not intended to be used with rules that are not
also managed by puppet; the behavior when doing so was undefined. This
is an attempt to make it more defined.

The behavior is that any rule added by puppet will be inserted in its
given order in relation to the other rules managed by puppet, but ahead
of any rules not managed by puppet.
add support for removing unmanaged firewall rules
add specs for chain purge
Update specs and make compatible with 1.8.7

`.keep_if` is not in Ruby 1.8.7
The resource was trying to change from chain INPUT to OUTPUT which isn't
supported.
(MODULES-441) Helpfully fail when modifying chains

It is not intended for chains to be modified using the firewall
resource, but it would still try and result in obscure incorrect errors.
This raises a more helpful error
Merge pull request #286 from hunner/fix_source

(MODULES-439) Work around existing rules
Merge pull request #287 from hunner/purge

Add purge support to firewallchain
Merge pull request #288 from hunner/fail_chains

(MODULES-441) Helpfully fail when modifying chains