iptables-legacy / iptables-nft plugin

Describe the solution you'd like

Two new plugins:

• linux.iptables — walks the ipt_table / ip6t_table kernel structures via ISF to extract iptables/ip6tables rules, outputting per-rule match
  expressions and targets (ACCEPT, DROP, REJECT, SNAT, DNAT, MASQUERADE, etc.) in a format similar to iptables-save.
• linux.iptables_nft — walks nf_tables kernel structures to extract rules loaded via nftables or the nft-backed iptables compatibility layer,
  decoding native nft expressions (meta, payload, cmp, nat, log, limit, range) and xt_compat match extensions side-by-side.

Both plugins should output: network namespace, address family, table, chain, policy, rule number, match string, and target.

Describe alternatives you've considered

Running iptables-save or nft list ruleset on a live system is not viable in a forensic context. No existing Volatility3 plugin covers firewall
state.

Additional information

Both plugins have been implemented and tested against Debian 11 and ubuntu 20.04. memory images captured with avml. They handle
Docker-generated rules, IPv6, interface negation, conntrack state matching, and nftables-native expressions. Code is available for review.

Start by reviewing the existing implementation described in the issue, then inspect the ISF ipt_table/ip6t_table and nf_tables entry points it walks. Validate it against Debian 11 and Ubuntu 20.04 AVML images, including Docker rules, IPv6, interface negation, conntrack matching, native nft expressions, and xt_compat extensions. Done means both plugins emit namespace, family, table, chain, policy, rule number, match, and target.