Add iptables runonce script

- Docker doesn't play nicely with nf_tables. Add a runonce script to use
update-alternatives to enable iptables-legacy. If at some point Docker
works right with nf_tables, we can get rid of this.

b/142268644

Change-Id: Ic38b51fb87d5251be66a6750b673b615e6dc9cee