Fix "--match set" support for newer iptables

Fix "--match set" support for newer iptables

The set module was merged into Linux 2.6.39 (d956798d) / iptables v1.4.9
(d40f1628). Unfortunately, the same iptables commit that merged it, also
deprecated support for --set in favor of --match-set (which was also
supported previously).

Hence using --set with iptables v1.4.9 results in the following warning,
printed in stderr:
  --set option deprecated, please use --match-set

This adds support for match-set to ferm and adjusts the test suite
accordingly. It does *not* remove "set" but makes it an alias to
"match-set" instead.

Due to the above, this /should/ be backwards-compatible both with older
ferm configurations and older iptables, since --match-set was supported
in the past.