Fix iptables rendering for combined icmp/icmpv6 protocols

[rootkiller6788]

Fixes #303.

The iptables generator skipped a term whenever any single protocol in its list did not match the term's address family:

if ((self.af == 'inet6' and 'icmp' in self.term.protocol) or
    (self.af == 'inet' and 'icmpv6' in self.term.protocol)):
  return ''

For a term such as protocol:: icmp icmpv6 this means the whole term is dropped for both address families, producing no iptables rules at all (while the packetfilter generator handles the same policy correctly).

This change filters the protocol list to the matching address family instead, returning early only when no protocols remain. With the fix, an inet filter renders -p icmp and an inet6 filter renders -p ipv6-icmp for the same term.

Testing

• Added testIcmpAndIcmpv6Protocol and testIcmpAndIcmpv6ProtocolInet6 to tests/lib/iptables_test.py.
• python -m pytest tests/lib/iptables_test.py passes (61 passed; testExpiringTerm fails independently of this change due to a local-vs-UTC date mismatch).