discovered NAT rules do not take Description
clarify & fix idempotency logic in update()

* we were not skipping services that were not specified
add an expectation on FATAL test message

... so that we do not see confusing output
clean up test output
remove potential for test input file name collision
correct tests for FirewallService idempotency
add missing NatService diff/idempotency tests
correct expectation with idempotency unit test
resolve merge conflicts