Replace iptables with nft and add support for masquerading clat-v6-addr

[toreanderson]

iptables has been deprecated for a while now. Its replacement nft allows for IPv6 masquerading, which allows clatd to operate without needing a global address separate from the host's primary one, cf. https://github.com/toreanderson/clatd/issues/23#issuecomment-1464883149.