switch to nftables upstream

[mkg20001]

it's just two ebtables packages and mesh-vpn-core that still have iptables dependencies... so we can just get rid of them and build something without legacy iptables

[mkg20001]

if iptables cli is still necesarry, "iptables-nft provides iptables" so it would not install xtables legacy, saving some hundred kbs