portMap: use nft sets instead of linear rules

[aroradaman]

The portmap plugins (nftables mode) adds a rule for each portmap/DNAT, with nftables we can benefit from verdict maps which will be an efficient lookup compared to linear match on each portmap rule.

plugins/plugins/meta/portmap/portmap_nftables.go

Lines 186 to 205 in abfac4a

	if useHostIP {
	tx.Add(&knftables.Rule{
	Chain: hostIPHostPortsChain,
	Rule: knftables.Concat(
	ipX, "daddr", e.HostIP,
	e.Protocol, "dport", e.HostPort,
	"dnat to", net.JoinHostPort(containerNet.IP.String(), strconv.Itoa(e.ContainerPort)),
	),
	Comment: &config.ContainerID,
	})
	} else {
	tx.Add(&knftables.Rule{
	Chain: hostPortsChain,
	Rule: knftables.Concat(
	e.Protocol, "dport", e.HostPort,
	"dnat to", net.JoinHostPort(containerNet.IP.String(), strconv.Itoa(e.ContainerPort)),
	),
	Comment: &config.ContainerID,
	})
	}

[aroradaman]

cc @danwinship