shared policy shouldn't have unshared rules

A shared firewall policy should always have shared rules. So the following
cases should not be allowed:
1.Create shared policy with unshared rules
2.Update policy shared=True when it has unshared rules
3.Update policy with shared=True and unshared rules
4.Update shared policy with unshared rules

Change-Id: I3d71899c328d3fefa96c1f99d6ba706160e445cc
Closes-bug: 1334981
Add unit-test assert to check dict is superset of dict

Several VPN unit tests need the ability to check that an expected
dict is found in the actual dict output (and that other elements are
ignored - like auth tokens).

Since this will be of use to other components, adding this to the
base test case.

Note: There is a similar assertDictContainsSubset(), however, it is
not supported in 2.6 and has been deprecated in 3.2. A different, and
hopefully clearer, name is used for this method.

Change-Id: I8becf9cfad966874f8463a9c835331f2f17d2ead
Closes-Bug: 1366797
Don't create unused ipset chain

when a security group don't have members, it should not create corresponding
ipset chain.

Change-Id: Ia04ffb3ac539c9a89a882e6dd91f373cb67c6f8b
Closes-bug: #1369431
Merge "Don't create unused ipset chain"
Merge "Add unit-test assert to check dict is superset of dict"
Merge "shared policy shouldn't have unshared rules"