match on bridge name in iptable masquerade rules
Instead of ip/netmask. This should be functionally equivalent (for
now), and makes it easier to identify the rule as belonging to
weave. Unfortunatley we must still match the source with ip/netmask,
since we are in the POSTROUTING chain and source interface matches
aren't valid there.

See also issue #20.