As per the comment, currently we're pulling in iptables-legacy because for some reason the `iptables` Provides is fulfilled by that instead of iptables-nft. Explicitly name the latter to avoid this. Note in tier-1 we do pull iptables-nft only because it's explicitly named there.