Network namespace wrapper for VPNaaS reference driver

Provides the wrapper required for Blueprint ipsec-vpn-reference

Strongswan that will be used for this first implementation can't
be launched several times in the same host "as is", because its
configuration, pid and control socket files location are hard coded.

As Strongswan will be launched in a network namespace using "ip netns"
command, it will also run in a mount namespace created by this command.

The solution consists in using a wrapper that bind-mount the required
directories in a speratate folder, this mount will only affect the subprocess
launched by the wrapper.

This wrapper also enforces rootwrap filter validation to make sure it can't
be used to run unauthorized commands as root

The wrapper can be launched as follow:
sudo /usr/local/bin/quantum-rootwrap /etc/quantum/rootwrap.conf \
ip netns exec test_ns quantum-netns-wrapper -d \
--cmd "ipsec, start" \
--mount_paths /etc,/var/run \
--mount_prefix /opt/stack/data/quantum/ipsec/ \
--rootwrap_config /etc/quantum/rootwrap.conf

Change-Id: I6e82e6b7ac9882b14a060e336d6b6199b74c13c8