Removed support for model VPN3K
Added attribute 'owner' to service definition.

Typically, the owner is definied at networks (or hosts).
A service S implicitly inherits the owner from a network N,
if S defines access to objects of network N.

The owner of network N can delegate the user management of a service S
to some other owner X.
In this use case, S gets an explicit owner X.
X is only allowed to change users of S.
X is not allowed to change the definition of S.
Renamed service 'owner' to service 'sub_owner'
v3.024