Fix func job hook script permission problems

- The hook script is the wrong place to unstack since
  it needs to run as the stack user with sudo privileges and those
  permissions are removed as part of the devstack-vm-gate.sh script.

- The functional job gate hook script needs to use sudo to
  install the test-only rootwrap filter.

Change-Id: Ib2e5ec016a5a414dd9675328650efb2b39b0e3fe
Related-Bug: #1360658
Merge "Fix func job hook script permission problems"