feat(firewall): use direct nftables when supported

[qdm12]

Description

• If the nftables backend is supported, use it with raw calls to it in Go (no iptables-nft etc). Otherwise, fallback on using iptables.
• Still use iptables for custom post rules (to be removed in v4)

Prerequirements

• Separate iptables specific code an implementation of the firewall
• Make iptables code more "atomic" so it resembles nftables' built-in atomicity

Issue

• may fix Bug: enabling firewall fails, Couldn't load match `conntrack' #1723
• fix Feature request: use google/nftables to handle nftables firewall #898
• maybe Bug: investigate if iptables-legacy must be changed if iptables-nft is already set #2414

Assertions

• I am aware that we do not accept manual changes to the servers.json file
• I am aware that any changes to settings should be reflected in the wiki