Migrate to netfilter (nftables)

Summary

We should move off of invoking iptables in our containerd runtime and use nftables (netfilter) instead. iptables has been labelled as legacy for MANY years now and are not enabled on newer kernels. Also seeing errors like this more often in our containerd integration tests:

starting task: network add: cni net setup: 
  plugin type="bridge" failed (add):
  failed to list chains: running [/usr/bin/ip6tables -t nat -S --wait]:
  exit status 3: ip6tables v1.8.11 (legacy):
  can't initialize ip6tables table `nat': Table does not exist (do you need to insmod?)
Perhaps ip6tables or your kernel needs to be upgraded.

Will probably change behaviour to detect if nftables is present and prefer using it over iptables, with iptables being present as a fallback.

Context

Past issues:

• https://github.com/concourse/concourse/issues/5136
• https://github.com/concourse/concourse/issues/4557

Docs for research: https://wiki.nftables.org/wiki-nftables/index.php/Moving_from_iptables_to_nftables https://github.com/google/nftables