beta::natfix removal step 1

beta::natdestrewrite is only used by beta::natfix.  Switching
it to ensure => absent first to remove the rules from the hosts
pending removal of the role/class.  This functionality was
replaced with dnsmasq hacks in:

aee21e6 Add public->private mappings for labs to dnsmasq aliases

Bonus upside: if anything breaks due to this, it's trivial to
revert.

Change-Id: Ie8d66c462abdb35c566f1c53607a0d07d84b2d62