This patch restores FEATURE_ROUTER_FIREWALL, since the corresponding
feature is still available in NSX 4.0.1 onwards, but dropt usage of
the deprecated nat_pass parameter in favour of firewall_match.
All existing supported NSX releases can leverage the firewall_match
parameter for NAT rules.
Change-Id: I1dd5d2582ee291ce08af541c1a9a30ea86b33503
(cherry picked from commit 7624236634aeed7eab5815912bc213a3f094df2b)
4d42bb0913