hooks: Security groups support for OVS

OpenStack Networking for OVS currently can't handle security groups on
the OVS bridge itself, so a hybrid approach is used where the tap device
is connected to a Linux bridge (on which the security groups can be
implemented), and it is connected in turn to the OVS bridge using a
"patch cable" made of a VETH pair.

This commit implements the logic stated by:
http://www.ovirt.org/Features/Detailed_OSN_Integration#Security_groups

Note: Migration support for OVS + security groups will be added in a
later patch.

Change-Id: I77e219cce9c572ebef6a8584847f517abbda224d
Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>
Reviewed-on: http://gerrit.ovirt.org/22585
Reviewed-by: Assaf Muller <amuller@redhat.com>
Reviewed-by: Dan Kenigsberg <danken@redhat.com>