Remove two-stage construction of commands in nwfilter
    
    The nwfilter ebiptables driver will build up commands to run in
    two phases. The first phase contains all of the command, except
    for the '-A' part. Instead it has a '%c' placeholder, along with
    a '%s' placeholder for a position arg. The second phase than
    substitutes these placeholders. The only values ever used for
    these substitutions though is '-A' and '', so it is entirely
    pointless. Remove the second phase entirely, since it will make
    it harder to convert to the new firewall APIs
    
    Signed-off-by: Daniel P. Berrange <berrange@redhat.com>