Enable policy control over port creation on shared nets

Issue: #17949

This patch introduces the create_on_shared policy for defining
which tenants should be allowed to create ports and subnets on
shared networks.
The default setting for this policy is rule:regular_user,
meaning that any tenant can create a port on a shared network.

This patch also introduces the 'notrole' policy check. This
check passes only if a tenant does not have the specified role.
This check can be used for disallowing access to a specific
operation to all tenants with a given role.

Also includes upstream fix for Bug 1186081

Change-Id: I21c54f63e1948675f67afb088c262dc5316c230d