base: disable iptables service when nftables is enabled

When `nftables=True` the base role deploys nftables rules and enables the
nftables service, but never disables the iptables service. On freshly
provisioned hosts the iptables service can be left running from cloud-init,
overwriting nftables rules and silently dropping traffic on ports defined
in `tcp_ports`.

Stop and disable the iptables service explicitly when nftables is the
intended firewall backend.

roles/base/tasks/main.yml

@@ -276,6 +276,16 @@
   - baseiptables|bool
   - not nftables
 
+- name: Iptables service disabled
+  service: name=iptables state=stopped enabled=false
+  tags:
+  - iptables
+  - service
+  - base
+  when:
+  - baseiptables|bool
+  - nftables
+
 - name: Nftables service enabled
   service: name=nftables state=started enabled=true
   tags: