Support for Istio Mesh + nft

[aviramha]

When users use Istio Mesh + nftables (not iptables legacy) our rules run before mesh, leading to undefined behavior.
We probably should have a flag - iptables_mode which can be either legacy or nft then we use the appropriate and all should work the same (in theory).
Need to manually test it to know better though.
Linkerd has similar modes. iptablesMode