base / iptables: don't remove iptables for now

This was a good change in theory, but in practice it's not.
The 'iptables-legacy' package provides 'iptables' so it gets removed,
but there's some things we still install that depend on it, so it just
gets pulled in later as a dependency.

Examples:

build* machines install oz and ImageFactory that need it
(but we can possibly drop those now)

virthosts have some libvirt subpackages that require it.

I'm not sure we can readd this in a targeted way or should just drop it
for now entirely.

Signed-off-by: Kevin Fenzi <kevin@scrye.com>

roles/base/tasks/main.yml

@@ -168,12 +168,12 @@
   - base
   when: nftables
 
-- name: Ensure iptables is not installed
-  ansible.builtin.package: state=absent name=iptables
-  tags:
-  - packages
-  - base
-  when: nftables
+#- name: Ensure iptables is not installed
+#  ansible.builtin.package: state=absent name=iptables
+#  tags:
+#  - packages
+#  - base
+#  when: nftables
 
 - name: Ensure ipset is installed
   ansible.builtin.package: state=present name=ipset