Improve handling of security group updates

Currently updates to security group rules or membership
are handled by immediately triggering a call to refresh_firewall.
This call is quite expensive, and it is often executed with a
very high frequency.

With this patch, the notification handler simply adds devices for
which the firewall should be refreshed to a set, which will then
be processed in another routine. The latter is supposed to
be called in the main agent loop.

This patch for 'provider updates' simply sets a flag for refreshing
the firewall for all devices.

In order to avoid breaking other agents leveraging the security
group RPC mixin, the reactive behaviour is still available, and is
still the default way of handling security group updates.

Patching into Havana as this fixes the issue of the agents flapping

Partial-Bug: #1253993
Partially implements blueprint: neutron-tempest-parallel

Cherry-picked from 5e6e592132aa9a98936ce3bfdb66efc7832caafb
                   3046c4ae22b10f9e4fa83a47bfe089554d4a4681
                   26d8231b0bf4050453bcb6122484c801eff852ca

Change-Id: Idc682f19ebfef4c00b6bb510ebd7d77775f4bbca
Merge "Improve handling of security group updates" into stable/havana
Merge remote-tracking branch 'upstream/stable/havana' into ovx