Ensure default IP policy on subnets

* Added API validation
* Added database migrations

RM7212
it was the latter :+1: re: moving to db.  thanks for clearing it up for me.