[MitchDrage]

Description

This PR fixes the virtual router's nftables restore at boot. rules.nftables was saved with nft list ruleset, which includes the iptables-nft tables. nft can't load those, so the whole restore failed and the IPv6 firewall and ACLs were missing after a reboot from the router's shell.

• New CsHelper.save_nftables saves every table except the iptables ones (filter, nat, mangle, raw, security) and ebtables' broute. The router's iptables rules are already saved in rules.v4 and rules.v6 and restored with iptables-restore.
• configure.py uses it in place of nft list ruleset.
• save_iptables and save_nftables now share a small write_lines helper.
• On routers with no nftables-only tables the file is empty, and the restore runs without error.

The iptables table names are fixed, so I chose to exclude those over naming the tables to keep. The set of nftables tables can grow, and #14620 adds one, for example.

Fixes: #14619

Types of changes

• Breaking change (fix or feature that would cause existing functionality to change)
• New feature (non-breaking change which adds functionality)
• Bug fix (non-breaking change which fixes an issue)
• Enhancement (improves an existing feature and functionality)
• Cleanup (Code refactoring and cleanup, that may add test cases)
• Build/CI
• Test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Bug Severity

• BLOCKER
• Critical
• Major
• Minor
• Trivial

Screenshots (if appropriate):

How Has This Been Tested?

• Unit tests in TestCsHelper: iptables tables and broute are left out, the IPv6 firewall, IPv4 routed firewall and other tables are kept, a router with only iptables tables gets an empty file, and save_iptables still writes the iptables-save output unchanged.
• A lab running the 4.20 router scripts (Debian 12, nftables 1.0.6). Each run applied the rules, flushed the ruleset and ran the restore block from postinit.sh, as a boot would:

Router	Before this PR	With this PR
Isolated, IPv6 firewall	Restore fails, IPv6 firewall missing, blocked source gets through	IPv6 firewall restored identically, blocked source still blocked
VPC, IPv6 ACL	Restore fails, ACL missing, blocked source gets through	ACL restored, blocked source still blocked
Routed mode, IPv4 firewall	Restores fine (run on main)	Restores fine
Isolated, no IPv6	Restore fails, nothing lost (also seen on production 4.22.1.1 routers)	Empty file, restore succeeds

IPv4 iptables rules were identical before and after the boot in every run.

How did you try to break this feature and the system with this change?

• Ran it on a router with no nftables-only tables, to check an empty file restores cleanly.
• Ran it in routed mode, where the IPv4 firewall is an nftables table, to check it's still saved.