DE505: Neutron firewall anti-spoofing fix to prevent ARP poisoning (related to DE714)

Partial-rally-bug: DE505
Not-in-upstream: true
Neutron firewall anti-spoofing fix to prevent ARP poisoning (realted to DE714)
OpenStack Neutron does not protect against arp cache poisoning on Provider/shared networks. 
The patch has been ported from the one submitted for Icehouse in CiscoSystems repo by Jeurgen Brendel (jbrendel@cisco.com)

Reference:
https://bugs.launchpad.net/neutron/+bug/1274034
http://wikicentral.cisco.com/display/OPENSTACK/OpenStack+Provider+Network+Security