Treat RHEL 7 and later like Fedora w/r/t iptables

RHEL 7 replaces legacy init with systemd, and must be treated like
Fedora w/r/t iptables persistence.  This patches checks
operatingsystemrelease in addition to operatingsystem in order
to differentiate between RHEL 7 and earlier releases.

Both RHEL 7 and recent Fedora releases require the iptables-services
package to support the commands in lib/puppet/util/firewall.rb.

This also corrects the path to /usr/libexec/iptables/iptables.init.
correct spelling of "&&" to "and"
fix errors noted by travis-ci

I like explicitly quoted strings, but apparently Travis doesn't.
Update firewall.rb

SNAT: typo in error message when tosource parameter is missing.
In lib/puppet/provider/firewall/iptables.rb we test on boolean flags when building iptables args:

        # If socket is true then do not add the value as -m socket is standalone
        if known_booleans.include?(res) then
          if resource[res] == :true then
            resource_value = nil
          else
            # If the property is not :true then we don't want to add the value
            # to the args list
            next
          end
        end

This evaluates to false on the reap flag in a definition like this:
    firewall { '001 rate limit ssh attempts':
        port   => [22],
        proto  => tcp,
        tcp_flags => "FIN,SYN,RST,ACK SYN",
        recent => 'rcheck',
        rsource => true,
        rname => 'ssh-syn4',
        rseconds => 30,
        rhitcount => 3,
        reap => true,
        jump => drop,
    }

This is because the value is not defined as a string, so the reap flag is not added to the args. This patch defines reap as a string true or false to match others like rsource.
Merge pull request #340 from simon-martin/master

--reap flag is not added to iptables command
Merge pull request #339 from cure/master

Fix typo in SNAT error message
Merge pull request #338 from larsks/master

Treat RHEL 7 and later like Fedora w/r/t iptables