Use an independent iptables lock per namespace

Since iptables is independent from namespace to namespace, it makes
sense to use an independent lock per namespace.  This improvement is
aimed at improving the parallel performance in the L3 agent.

Partially implements blueprint: neutron-tempest-parallel

Change-Id: I15e9c9da9a7c15981757a09bc744501722d62db2
Merge "Use an independent iptables lock per namespace"