Add unit tests for Felix

This constitutes a reasonable level of cover for Felix (86% is being reported to me), though requires some work to get it cleaned up and to 100% coverage (notably in `test_felix`, which is just too long but still does not have enough coverage).

The biggest issue with it is that where I have stubbed out code, I have often used global variables to track system state. That's ugly, but has no major downsides for now, so I proposing leaving as is for now (sorting it out would require some code refactoring, but is not a huge job).

Sample test output is the following.

    C:\work\git\calico>nosetests --with-coverage 2>&1 | more
    ...............'iptables' is not recognized as an internal or external command, operable program or batch file.
    'iptables' is not recognized as an internal or external command, operable program or batch file.
    'ip6tables' is not recognized as an internal or external command, operable program or batch file.
    'iptables' is not recognized as an internal or external command, operable program or batch file.
    'ip6tables' is not recognized as an internal or external command, operable program or batch file.
    .'iptables' is not recognized as an internal or external command, operable program or batch file.
    ..'iptables' is not recognized as an internal or external command, operable program or batch file.
    ...........
    Name                    Stmts   Miss  Cover   Missing
    -----------------------------------------------------
    calico.felix                0      0   100%
    calico.felix.config        76      0   100%
    calico.felix.devices       40      0   100%
    calico.felix.endpoint      85     18    79%   46, 130-132, 147-148, 159, 163-168, 173-175, 178-181, 209-214
    calico.felix.felix        291     88    70%   173-176, 195, 220-227, 246-250, 262-267, 306-308, 338, 351-387, 402-404, 428-431, 448-452, 457-458, 481, 499-503,
    508, 558-561, 564-565, 568-569, 572-574, 627-649, 657-658, 661-662, 668, 680, 701, 706-728, 731
    calico.felix.frules       342     21    94%   103, 133, 412, 584, 603, 623-626,637-640, 648, 657-675
    calico.felix.fsocket      105     10    90%   78-80, 122-124, 144-146, 163
    calico.felix.futils        36      0   100%
    calico.felix.ipsets        25      0   100%
    -----------------------------------------------------
    TOTAL                    1000    137    86%
    ----------------------------------------------------------------------
    Ran 29 tests in 0.224s

    OK

The tedious complaints about `iptables` not being present are benign, and are due to the hack in place to deal with issue #35, which hopefully we can retire shortly.

Is this the best logic? In `create` you assume that an error leaves undefined state, and try to create anyway. What about simply using `call_silent` to immediately call `ipset destroy`?