Better iptables DROP removal.

With the introduction of configurable iptables DROP rules in
nova-network, we need to cleanup possibly more than one drop
rule, depending on what DROP action was in place when the rule
was created. This patch handles this for the simple case where
the drop action has just been configured. More complicated
scenarios will need to be handled manually.

Change-Id: I660607ff6e23ca545f96e536d1084d972bc7c7a2
Merge "Better iptables DROP removal."