match on bridge name in iptable masquerade rules

Instead of ip/netmask. This should be functionally equivalent (for
now), and makes it easier to identify the rule as belonging to
weave. Unfortunatley we must still match the source with ip/netmask,
since we are in the POSTROUTING chain and source interface matches
aren't valid there.

See also issue #20.

weaver/weave

@@ -49,8 +49,8 @@ add_nat_rule() {
 }
 
 setup_masquerading() {
-    add_nat_rule "POSTROUTING -d $IPADDR ! -s $IPADDR -j MASQUERADE"
-    add_nat_rule "POSTROUTING -s $IPADDR ! -d $IPADDR -j MASQUERADE"
+    add_nat_rule "POSTROUTING -o $BRIDGE ! -s $IPADDR -j MASQUERADE"
+    add_nat_rule "POSTROUTING -s $IPADDR ! -o $BRIDGE -j MASQUERADE"
 }
 
 case "$COMMAND" in