Check that 'iptables -w' is supported before using it

'-w' was only introduced in a recent version of iptables.  It means
"Wait for the xtables lock", so it seems reasonable to proceed without
it for older versions.
Merge pull request #25 from dpw/24_iptables_w

Check that 'iptables -w' is supported before using it

Fixes #24
explain the 'iptables -w' check
update diagrams
make app isolation example easier to read
simplify 'weave run' examples
we don't need to specify /bin/bash, since that is the default
entrypoint