Fix IP Policy creation

- ensure db_api.ip_policy_create is only called once
- fail early if subnet or network already has IP Policy
- ensure default IP Policy CIDRs aren't duplicated

RM3793