Allow attaching external networks based on configurable policy

Commit da66d50010d5b1ba1d7fc9c3d59d81b6c01bb0b0 restricted
attaching external networks to admin clients. This patch changes
it to a policy based check instead with the default setting being
admin only. This allows operators to more precisely configure who
they wish to allow to attach external networks without having to
give them admin access

Change-Id: I59e71f117f889f2abffddc36c1870ef1e0fe3711
DocImpact: Adds network:attach_external_network policy
Closes-Bug: #1352102
Merge "Allow attaching external networks based on configurable policy"