Fix nats firewall test to check nftables instead of iptables

[selzoc]

Summary

The ipv6 nats firewall integration test was still querying ip6tables for
cgroup-based rules, but the firewall now uses nftables with UID-based matching.
This has been failing consistently since b791d6c changed the Mbus URL from
mbus:// to nats://, which activated the nftables code path for ipv6.

• Query nft list chain inet bosh_agent nats_access instead of ip6tables -t mangle -L
• Update regex expectations to match nftables UID-based output
• Fix AfterEach cleanup (was using ip6tables -D with wrong port 8080 and nonexistent cgroup rules)

CI Failure

build 1092 — 47 Passed, 1 Failed

[FAILED] Expected
<string>: Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
to match regular expression
<string>: ACCEPT tcp anywhere 2001:db8::1 tcp dpt:http-alt cgroup 2958295042
In [It] at: /tmp/build/22f0b5c7/bosh-agent/integration/nats_firewall_test.go:99

The AfterEach also failed trying to delete the nonexistent iptables rules:

FAILED TO EXECUTE: sudo ip6tables -t mangle -D POSTROUTING -d 2001:db8::1
-p tcp --dport 8080 -m cgroup --cgroup 2958295042 -j ACCEPT --wait
Process exited with status 1