We only ship iptables-nft, so there's no need to explicitly override the symlinks anymore. To enforce this remains the case, add `iptables-legacy` to the exclusion list.