Fix func job hook script permission problems

- The hook script is the wrong place to unstack since
  it needs to run as the stack user with sudo privileges and those
  permissions are removed as part of the devstack-vm-gate.sh script.

- The functional job gate hook script needs to use sudo to
  install the test-only rootwrap filter.

Change-Id: Ib2e5ec016a5a414dd9675328650efb2b39b0e3fe
Related-Bug: #1360658
(cherry-picked from commit 2f7932055247df3ac5ec4783e029cfeda0466f71)
Merge "Fix func job hook script permission problems" into stable/icehouse