Allow to configure CIDR exclusion blocks

It could be useful to be able to express exclusion CIDR blocks when configuring firewalls. For example, CloudSigma allows to configure firewall rules with something like `!192.168.0.0/24` to allow traffic from any IP address outside that range.

This change should also simplify a lot that provider and unlock https://github.com/jclouds/jclouds-labs/pull/70
Stupid question...do we need this if we already have `skipIfSecurityGroupsNotSupported` at the beginning?