Import nftables maps: one port forward or rule per element

A DNAT map (named or anonymous) becomes one port forward per element,
named after the map; a verdict map becomes one rule per element, in
place, with jumps inlined. A lookup matches one element at most, so the
expanded rules do the same. A named map that can't be expanded (keyed by
several fields) is left out with a note instead of a raw rule naming it,
which nftables would refuse. Test fixture made with nft 1.1.3.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/importer/testdata/maps.nft

@@ -0,0 +1,36 @@
+# Maps and verdict maps, as found in hand-written rulesets (importer_test.go).
+table inet main {
+	map portforwards {
+		type inet_service : ipv4_addr . inet_service
+		elements = { 443 : 192.168.1.50 . 443, 80 : 192.168.1.50 . 8080 }
+	}
+	map hosts {
+		type inet_service : ipv4_addr
+		elements = { 2222 : 192.168.1.60 }
+	}
+	map lan_services {
+		type inet_service : verdict
+		elements = { 22 : accept, 23 : drop, 80 : jump web }
+	}
+	map pairs {
+		type ipv4_addr . inet_service : verdict
+		elements = { 192.168.1.9 . 22 : accept }
+	}
+	chain web {
+		ip saddr 192.168.1.0/24 accept
+	}
+	chain prerouting {
+		type nat hook prerouting priority dstnat; policy accept;
+		iifname "wan" dnat ip to tcp dport map @portforwards comment "Port forwards"
+		iifname "wan" dnat ip to tcp dport map @hosts
+		iifname "wan" dnat ip to udp dport map { 5000 : 192.168.1.70 . 5001, 6000 : 192.168.1.71 . 6000 }
+	}
+	chain input {
+		type filter hook input priority filter; policy drop;
+		ct state established,related accept
+		iifname "lan" tcp dport vmap @lan_services
+		iifname "wan" udp dport vmap { 53 : accept, 123 : drop }
+		ip saddr vmap { 10.0.0.0/8 : accept, 192.0.2.1 : drop }
+		ip saddr . tcp dport vmap @pairs
+	}
+}