Import nftables maps: one port forward or rule per element

A DNAT map (named or anonymous) becomes one port forward per element,
named after the map; a verdict map becomes one rule per element, in
place, with jumps inlined. A lookup matches one element at most, so the
expanded rules do the same. A named map that can't be expanded (keyed by
several fields) is left out with a note instead of a raw rule naming it,
which nftables would refuse. Test fixture made with nft 1.1.3.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -52,7 +52,8 @@ the way Jarl and Steward are.
 - **Import** of an existing nftables ruleset (`hc import`): rules keep
   their order, defines name the sets, DNAT becomes port forwards, what
   can't be translated stays as raw rules, with notes; `hc takeover`
-  deletes the old table, on probation (docs/import.md).
+  deletes the old table, on probation (docs/import.md). DNAT maps and
+  verdict maps are expanded into one port forward or rule per element.
 - **The `hc` CLI, the REST API and the web UI** (dashboard, rules per
   chain with hits and reordering, NAT, zones, sets, services, the log,
   settings, import, history with undo), with users, roles, scoped API