purge unmanaged firewall rules with ignore support

This adds support for purging unmanaged firewall rules, with the ability to specify rules that should be ignored.

The previous method of purging firewall rules required `resources { 'firewall': purge => true }`. This would purge all unmanaged firewall rules unconditionally.  
This change introduces the ability to do the following:

```
  firewallchain { 'INPUT:filter:IPv4':
    policy => 'drop',
    purge  => true,
    ignore => [
      '-j fail2ban-ssh',
      '--comment "[^"]*(?i:ignore)[^"]*"',
    ],
  }
```

That example will tell puppet purge rules in the `INPUT:filter:IPv4` chain (so this change also adds per-chain purge support). The purge will also skip the jump rule added by fail2ban, and also skip any rule with "ignore" in the comment (it will still properly behave if puppet itself added the rule).