Avoid referencing stale instance/network_info dicts in firewall

This makes the virt.firewall code cleaner in terms of referencing
the cached instance and network_info code it stores. Before this
patch, concurrent instance operations could modify these two dicts
so that while we're iterating instances, the network_info dict
is suddenly missing information we need.

The right fix for this is to use instance objects and their
associated info_cache objects, but that's a larger fix and one
not as well-suited to backporting to previous releases which
suffer from this as well.

The approach taken here is that we store the instance and
network_info cache together in the same dict that we can pop()
from atomically (this is not really necessary, but helps to
prevent introducing more of these cases). When we iterate over
the contents, we iterate over a copy of the keys, being careful
not to let a suddenly-missing key break us, and passing the
details all the way down the stack instead of having deeper calls
hit the cache dicts again.

Conflicts:
	nova/virt/firewall.py

Change-Id: Ib1cfd68fca7789ca4a3602c25e6b8a956303fff9
Closes-bug: #1182131
(cherry picked from commit 72dd81343e73baf838bc58d413413f0d57018f15)
(cherry picked from commit 9f5d2a6a65edb2a5862c7f07b29ac700cec61f84)
Fix rootwrap for non openstack.org iqn's

The encryption methods implemented for attached volumes
require a symbolic link created to the /dev/disk-by* iqn.

The current implementation works fine for LVM, however the rootwrap
is restricted to only allow iqns of the form openstack.org, for
vendors that use their own target and iqn this won't work and will
result in the attach failing for unauthorized command.

This just makes the regex for the rootwrap filter a bit more
permissive, only looking for iscsi-iqn.*

Closes-Bug: 1362854
(cherry picked from commit 00808f2072c3ee8958ad16eabad7994730bb8b86)

Change-Id: I023ad24867c045a88f72c5ac7ac4e4da097a3643
Conflicts:
	etc/nova/rootwrap.d/compute.filters
Merge "Avoid referencing stale instance/network_info dicts in firewall" into stable/havana
Merge "Fix rootwrap for non openstack.org iqn's" into stable/havana