Block access to meta-data proxy from external IPs

The metadata proxy is accessible from the outside world, per:
https://bugs.launchpad.net/neutron/+bug/1350975.

This patch sets up iptables rules to block access to the the qg
interface from anywhere but localhost.

Closes-rally-bug: DE513
Closes-bug: #1350975
Not-in-upstream: true