xenapi: enforce filters after live-migration

Currently and network filters, including security groups, are
lost after a server has been live-migrated.

This partially fixes the issue by ensuring that security groups are
re-applied to the VM once it reached the destination, and been started.

This leaves a small amount of time during the live-migrate where the VM
is not protected. There is a further bug raised to close the rest of
this whole, but this helps keep the VM protected for the majority of the
time.

Fixes bug 1202266

(Cherry picked from commit: 5cced7a6dd32d231c606e25dbf762d199bf9cca7)

Change-Id: I66bc7af1c6da74e18dce47180af0cb6020ba2c1a
xenapi: apply firewall rules in finish_migrate

When security groups were added, the rules were not re-applied to
servers that have been migrated to a new hypervisor.

This change ensures the firewall rules are applied as part of creating
the new VM in finish_migrate. This code follows a very similar pattern
to the code in spawn, and that is where the cut and paste code comes
from. This code duplication was removed in Havana.

Fixes bug 1073306

Change-Id: I6295a782df328a759e358fb82b76dd3f7bd4b39e
Merge "xenapi: apply firewall rules in finish_migrate" into stable/grizzly
ensure we don't boot oversized images

Since we can't generally shrink incoming images, add extra checks
to ensure oversized images are not allowed through.
All cases when populating the libvirt image cache are now handled,
including the initial download from glance, where we avoid
converting to raw, as that could generate non sparse images
much larger than the downloaded image.

* nova/virt/libvirt/utils.py (fetch_image): Allow passing through
of the max_size parameter.
* nova/virt/images.py (fetch_to_raw): Accept the max_size parameter,
and use it to discard images with larger (virtual) sizes.
* nova/virt/libvirt/imagebackend.py (verify_base_size): A new
refactored function to identify and raise exception to oversized images.
(Raw.create_image): Pass the max_size to the fetch function.
Also enforce virtual image size checking for already fetched images,
as this class (despite the name) can be handling qcow files.
(Qcow2.create_image): Pass the max_size to the fetch function,
or verify the virtual size for the instance as done previously.
(Lvm.create_image): Pass the max_size to the fetch function.
Also check the size before transferring to the volume to improve
efficiency by not even attempting the transfer of oversized images.
(Rbd.create_image): Likewise.
* nova/tests/fake_libvirt_utils.py: Support max_size arg.
* nova/tests/test_libvirt.py (test_fetch_raw_image):
Add a case to check oversized images are discarded.
* nova/tests/test_imagebackend.py (test_create_image_too_small):
Adjust to avoid the fetch size check.

Fixes bug: 1177830
Fixes bug: 1206081

Conflicts:

	nova/tests/test_imagebackend.py
	nova/virt/libvirt/imagebackend.py

Change-Id: Idc35fce580be4f74e23883d1b4bea6475c3f6e30
Merge remote-tracking branch 'upstream/stable/grizzly' into stable/grizzly