DE505: Neutron firewall anti-spoofing fix to prevent ARP poisoning (related to DE714)

Partial-rally-bug: DE505
Not-in-upstream: true
  
Neutron firewall anti-spoofing fix to prevent ARP poisoning using ebtables (related to DE714)
OpenStack Neutron does not protect against arp cache poisoning on Provider/shared networks. 
  
Reference:
https://bugs.launchpad.net/neutron/+bug/1274034
http://wikicentral.cisco.com/display/OPENSTACK/OpenStack+Provider+Network+Security
  
The patch has been derived from the one submitted for Icehouse in CiscoSystems repo by Jeurgen Brendel (jbrendel@cisco.com)