add remove NAT rules

add support for closePortForwarding for PortForwarderVcloudDirector
refactor VcloudDirectorSubnetTierLiveTest to create a VM for the test
modify NatService: networkId is no more required by the user
I'm tempted for us to keep the old test, and have this new test as well.

I like that the old way is fast to run and doesn't cost anyone a VM. But I agree we also want a test like this, which actually checks that the port is really reachable over NAT.

If that would be way too much duplication, then perhaps have a common `runOpenPortForwardingAndAdvertise(...)` that takes as a param the `EntitySpec` for the child (so can be `TestEntity` or `MachineEntity`).