Add support for connlimit and connmark

This adds support for the use of connlimit and connmark
eg.
```
  firewall { '400 connlimit exceeded LOG':
    chain           => 'INPUT',
    proto           => 'tcp',
    dport           => '22',
    connlimit_above => '10',
    connlimit_mask  => '32',
    connmark        => '0x1',
    log_prefix      => '* connlimit exceeded *',
    jump            => 'LOG',
  }

  firewall { '300 192.168.1.0/24 MARK':
    chain    => 'PREROUTING',
    table    => 'mangle',
    proto    => 'tcp',
    set_mark => '0x1/0xffffffff',
    jump     => 'MARK',
  }
```