Reverse the order of interface update and DNAT rule config

Configure DNAT rule first before adding floating ip address to interface
so advanced service router will not receive packets by accident before
DNAT rule configured.

Verified that traffic goes to the VM the created floating ip associated
with right after config.

Change-Id: I415d1138511f41c209f1f2a9c2f12c2cfd3d16f0
Closes-Bug: #1229548
Fix to enable delete of firewall in PENDING_CREATE state

Firewall will in PENDING_CREATE state if there is no underlying router in the
tenant. When the router and an associated i/f is created then with a sequence
of msgs it is set to ACTIVE state by the plugin. If a delete is triggered when
in PENDING_CREATE state in such a situation, the msg was ignored - fixing this to
account for the fact that a delete makes sense in this situation so the agent
sends the appropriate msg back to the plugin so it can delete it.

Change-Id: Id1db0a8413fd815b518fe4dc57fc6277c09e7f00
Closes-Bug: #1223478
Merge "Reverse the order of interface update and DNAT rule config"
Merge "Fix to enable delete of firewall in PENDING_CREATE state"