xenapi: enforce filters after live-migration

Currently and network filters, including security groups, are
lost after a server has been live-migrated.

This partially fixes the issue by ensuring that security groups are
re-applied to the VM once it reached the destination, and been started.

This leaves a small amount of time during the live-migrate where the VM
is not protected. There is a further bug raised to close the rest of
this whole, but this helps keep the VM protected for the majority of the
time.

Fixes bug 1202266

(Cherry picked from commit: 5cced7a6dd32d231c606e25dbf762d199bf9cca7)

Change-Id: I66bc7af1c6da74e18dce47180af0cb6020ba2c1a
xenapi: apply firewall rules in finish_migrate

When security groups were added, the rules were not re-applied to
servers that have been migrated to a new hypervisor.

This change ensures the firewall rules are applied as part of creating
the new VM in finish_migrate. This code follows a very similar pattern
to the code in spawn, and that is where the cut and paste code comes
from. This code duplication was removed in Havana.

Fixes bug 1073306

Change-Id: I6295a782df328a759e358fb82b76dd3f7bd4b39e
Merge "xenapi: apply firewall rules in finish_migrate" into stable/grizzly
Merge branch 'stable/grizzly' of https://github.com/openstack/nova into kbenton/ivssupport_grizzly