Handling no-security-group on VMIs

When there are not security groups for a port (even the default
one), contrail allows all sorts of packets to PASS, but
Openstack expects that, on such occasion, any packet should be
DROPPED.

This is solved using a internal-only security group which is not
visible to the client programs, and has empty rule-set. When a
port wants no-security-group attached to it, the no-rule group
is associated to it internally.

Closes-bug: #1381901

Change-Id: I5348e05682d97773760ffefa7d988468adf08c13
Merge "Handling no-security-group on VMIs" into R1.10