nixos/nat: add forwardPorts for external->internal DNAT

Especially useful when you want to access services in containers from the outside directly without any proxy in the middle.
Added basic shape via e6ab680cbfb8165b51c829303b63eb44a905e751