luci-app-firewall: introduce support for "config nat" sections