Separate ipv4 and ip6 functionality

[martinb3]

It's becoming harder and harder to guess which rules will apply cleanly to ip6tables-restore, so we probably just need to make an explicit way to let firewall_rule indicate if it should apply to ipv4, ipv6, or both. This would take a lot of guesswork out of the process, and cleanup the logic in the cookbook tremendously.