Use netns to block network access from nova-manage.

This is done for security reasons as we don't trust the code running
inside migrations.

Change-Id: I86190fbd515ecf7683194923df14e5b707ab21c5