modules: iptables: correctly parse `--nfmask`/`--ctmask`
modules: iptables: correctly parse `--nfmask`/`--ctmask`

`iptables-save` can return rules like this one:

```
-A PREROUTING -m connmark ! --mark 0x0/0xffff0000 -j CONNMARK \
--restore-mark --nfmask 0xffff0000 --ctmask 0xffff0000
```

which leads to the following behavior:

```
$ salt '*' iptables.get_rules
minion:
    Minion did not return. [No response]
```

This commit fixes the behavior of `iptables.get_rules` in this case,
which also fixes the `iptables.append` state when such a rule already
exists on the minion.

saltstack/salt,saltstack/salt,saltstack/salt,saltstack/salt,saltstack/salt