remove masquerading rules on 'weave stop/launch'
Leaving iptable masquerading rules behind is a bad idea when weave is
re-launched with different ip subnet settings. So now we remove the
rules on 'weave stop' and also on 'weave launch' (in case weave had
been stopped in ways other than 'weave stop').

To make the rule removal easier, we create the rules in a user-defined
WEAVE chain.

Note that this will break old weave installations, since the rules
created by those are left behind. Easiest upgrade path is to restart
the machine. Or, for the brave, run `iptables -t nat -S POSTROUTING | grep weave | sed 's/^\-A/-D/g' | while read line; do iptables -t nat $line; done`.

Fixes #48