Add a util/exec interface for testing execs.

Peeled off from ip-per-service
Another approach would be to write an interface for iptables instead, with a real and fake implementation. For testing the real implementation, it'd be nice to actually run the commands (in a chroot/container or something?) and perform assertions on the iptables config file (that is what you're changing, right?). Otherwise, given this os/exec wrapping layer, I suspect you'll end up testing that some specific set of commands are called, which is better than nothing but is more of a change-detector than a correctness-detector.