Retry ebtables on race

Calls to ebtables can race with libvirt and cause nova, or libvirt
to fail to apply ebtables rules.

The goal of this patch is to provide a simple fix to improve the
stability of the gate.

We now call ebtables in a simple loop that retries on failure.
Long term we want to update nova to make use of the --concurrent
flag in newer versions of ebtables. The --concurrent flag
implements a lock to prevent multiple invocations of ebtables from
racing. This will require a newer libvirt and the ability to
timeout long running execs (--concurrent can block forever if it
never gets the lock).

A future patch is forthcoming to add support for --concurrent.

DocImpact
Add ebtables_exec_attempts option (default=3).

Change-Id: I3e04782ac4678581462f9bee4bb10d5f3b223457
Partial-Bug: #1316621
Merge "Retry ebtables on race"