Neutron firewall anti-spoofing fix to prevent ARP poisoning using ebtables

OpenStack Neutron does not protect against arp cache poisoning on Provider/shared networks. The patch has been derived from the one submitted for Icehouse in CiscoSystems repo by Jeurgen Brendel (jbrendel@cisco.com)

http://wikicentral.cisco.com/display/OPENSTACK/OpenStack+Provider+Network+Security

Partial-bug: #1274034
Partial-rally-bug: DE505