Migrate GitLab and NixOS runners from iptables to nftables

[emmacasolin]

Specification

Once the GitLab runner supports nftables we should migrate our iptables usage over to nftables. There are many reasons for doing this, including:

• iptables is becoming obsolete and is being replaced with nftables
• nftables is more customisable and has more options than iptables
• iptables uses a lock (xtables.lock) that is not restricted to individual namespaces (we've had problems with this in the past) - nftables doesn't use thisover xtables.lock so this can be removed

We already have nftables equivalents of the commands we're using in our NAT utils. They can be found here in our wiki: https://github.com/MatrixAI/js-polykey/wiki/nat-traversal#nat-traversal-testing

Additional context

• Tests for NAT-Traversal and Hole-Punching #381 - NAT traversal tests
• Tests for NAT-Traversal and Hole-Punching #357 (comment) - Discussion of bypassing xtables.lock issues in CI/CD
• https://github.com/MatrixAI/js-polykey/wiki/nat-traversal#nat-traversal-testing - nftables versions of our iptables commands
• https://gitlab.com/MatrixAI/Engineering/Maintenance/gitlab-runner/-/issues/22#note_989855213 - GitLab issue for updating the runners there

Tasks

1. Change GitLab runner image from iptables-legacy to nftables
2. Change NAT utils to use nft commands instead of iptables commands
3. Remove xtables.lock temp fixes from GitLab runner
4. Update the describeIf and testIf usage in the NAT tests to check for the existance of the nft command rather than the iptables command

[CMCDragonkai]

@brynblack

The runner right now has changed to using github: https://github.com/MatrixAI/Orchestrator/blob/3efc19346792e4510a0a7de89c84837251c6a127/flake.nix#L28-L59.

This https://github.com/MatrixAI/gitlab-runner-docker has now been archived. And I'll delete gitlab-runner-nix as it's not relevant yet.

Furthermore - I believe we stopped doing NAT testing inside a single-repo because it was too flaky and difficult, but instead this will now be done as part of https://github.com/MatrixAI/Polykey-Simulation... but again I think that may all be rolled into the Orchestrator/Mainnet/Testnet work. MatrixAI/Polykey-CLI#37 (comment)

In that case, this issue is no longer relevant, as no iptables/nftables is involved in single-repo testing anymore.