Use netns to block network access from nova-manage.

This is done for security reasons as we don't trust the code running
inside migrations.

To run this:
 - bind mysql to 0.0.0.0
 - run makenetnamespace.sh as root at boot, passing in the mysql root
   password so that user perms can be setup
 - add this to the sudo config:
   turbo-hipster ALL=(root) NOPASSWD: /sbin/ip netns exec nonet *

Change-Id: I86190fbd515ecf7683194923df14e5b707ab21c5