port/builtin: switch from iptables to nft for transparent routing

[Akshitguptaa]

Fixes #589

[AkihiroSuda]

Let's keep iptables mode too and test the both in CI

[Akshitguptaa]

kept iptables as a fallback.
CI runs test with both nft and iptables, and a separate one with only iptables (no nft) to cover the fallback path.

[AkihiroSuda]

Thanks, looks good, but let me check this again by the end of the month

[Akshitguptaa]

Thanks, looks good, but let me check this again by the end of the month

One thing worth a look before then: PortDriverInfo.Extra currently reports the configured --source-ip-transparent-backend, not the runtime-selected one. Backend selection happens lazily on the first transparent connection, so Extra can say "auto" while the child is actually running iptables (or hasn't decided anything yet).

Two ways to fix it:

1. make routing setup eager (run at init, not lazily on first connection) - smaller diff, but changes existing behavior: firewall rules get installed at startup even if source-ip-transparent is never actually used

2. keep it lazy, make Info() a live on-demand query to the child - bigger diff, no behavior change

Which do you prefer?

[AkihiroSuda]

Thanks, 1 seems better