Disable volume attach/detach for suspended instances

As described in the bug - some hypervisors (libvirt) do not support
this. It is best to disable it in the API to provide a consistent user
experience.

Also adds a test to prevent an accidental regression.

Change-Id: I5b404cca22cffecbaf524e2511810e5341242052
Closes-bug: #1240922
Use binding:vif_details to control firewall

Neutron can include 'ovs_hybrid_plug' and 'port_filter' boolean keys in
the binding:vif_details port attribute. 'port_filter' indicates whether
or not neutron is handling port filtering for nova to determine if it needs
to filter for that port. 'ovs_hybrid_plug' can be set to True to indicate
that the neutron plugin still requires the bridge plugging strategy to attach
firewall rules.

Corresponding neutron patch:
Review -  https://review.openstack.org/#/c/83280/
Commit -  8c42ba115b58cc2c7486be9fee89e1facedb5f76

Closes-Bug: 1297469
Change-Id: I3bbcfc67036ab7389c82720add0bc0fc627bfee0
Merge "Use binding:vif_details to control firewall"
Merge "Disable volume attach/detach for suspended instances"