The iptables module should allow inversion on "recent" extension

The current version of the puppetlabs/firewall module does not support inversion of the iptables recent extension. For example, a firewall resource cannot be constructed to generate the rule:

-A CUSTOM -m recent --name tracking ! --rcheck -j SET

This inversion is supported by the underlying iptables command and is useful in setting up rate-limiting and preventing brute-force DDOS attacks.