fixed warnings
Better check and optimize networks in subnet relation.

The notion of 'any object' has been split to 'security zone' and
'aggregate'.

A security zone or in short, zone is contiguous part of the topology
with managed devices at its border and only unmanaged devices inside
the zone.

An object 'any:X' or 'any:[...]' aggregates networks inside a zone.
Until now, an aggregate matches all networks inside a zone.  This
version introduces aggregates with ip/mask, matching only networks
inside the zone, which are a subnet of ip/mask.

Attributes 'owner' and 'no_in_acl' for a zone can still be set with an
aggregate having no mask or mask 0.

This version has much more checks and optimizations for networks A < B
in subnet relation, where both networks are located inside the same
zone.

- It checks and warns for redundant rules for A and B.

- A inherits the owner of B.

- Checks for missing any rules have been extended to all supernets,
  i.e. all networks having one or more subnets.  For each rule having
  a supernet as source or destination, the path from source to
  destination is checked.  If some zone on the path contains networks
  Ni matching the supernet, it is checked, that the same rule is also
  defined for a supernet or aggregate of all Ni. If only a single N1
  matches, it is sufficient to have the same rule with N1.

Netspoc gives a warning for an undeclared subnet relation.
It can be declared with attribute 'subnet_of' at subnet.
Previously, a supernet could be declared with attribute 'route_hint'.
This has been replaced by attribute 'has_subnets'.
The restrictions of 'route_hint' are gone.
A supernet can have hosts now and can freely be used in rules.
Restricted check_aggregate_rules for reverse rules.

Reverse rules need not to be checked, if some stateful, non secondary
device filters on path from src to dst.
Added protocol modifier no_check_aggregate_rules.

If this modifier is set, rules with this protocol will not be checked
for missing aggregate rules.
Added command line switch check_aggregate_rules
Clarify message for missing reversed aggregate rule
Fixed secondary optimization.

Also search aggregate rules for for non aggregate src/dst.
Fixed interface:[aggregate:xx]

Now only implemented for aggregate with mask 0.
Check NAT of networks in subnet relation.

Two networks A < B are in subnet relation and loacted inside the same
security zone. NAT must be defined consistently for both networks.
The subnet relation must remain intact after NAT has been applied.
NAT is consistent if
a) both networks have no NAT definitions or
b) B is aggregate with mask 0 (and no NAT) or
c) both have identical NAT tags and consistent NAT definitions for all tags
  - both have dynamic NAT to the same address range or
  - both have static NAT; NAT(B) applied to A is identical to NAT(A).
d) A can have one additional NAT tag only if this tag is applied
   inside the zone at network B.
Use no_nat_set of incoming interface in check_aggregate_rules
Check also for supernets in check_aggregate_rules.

But ignore interfaces with global pathrestriction.
Check if ip of aggregate matches mask.
Renames

- all_zones, all_areas to zones, areas.
- many occurrences of 'aggregate' to any, supernet.
- protocol modifier src|dst_zone back to src|dst_any
Set {is_supernet} for all networks with same ip.
Use variable %zones, not unexported @all_zones.
Removed useless call to is_aggregate in expanded_rules.
fixed warnings
Aggregate networks are no longer linked to router, but only to
corresponding zone.
Set attributes of zone at aggregate with ip 0/0.

Attributes 'owner' and 'no_in_acl' ar handled.
Set $zone->{loopback}, only if exactly one network