manifest: add 35coreos-iptables overlay

This overlay contains a script allowing existing nodes to opt-out from
the iptables-nft migration.

We should remove it after a barrier release.

The overlay was added in
coreos#1324.

manifest.yaml

@@ -26,6 +26,11 @@ add-commit-metadata:
 packages:
  - microdnf
 
+# Scripts for opting into staying on iptables-legacy after migration. Lower into
+# `fedora-coreos-base.yaml` once we're ready to migrate `testing`.
+ostree-layers:
+  - overlay/35coreos-iptables
+
 postprocess:
   # Disable Zincati and fedora-coreos-pinger on non-production streams
   # https://github.com/coreos/fedora-coreos-tracker/issues/163