VPNaaS: Separate validation for Cisco impl

Moving validation logic from Cisco service driver, into a
validation subclass, so that it'll be applied during the
persistence phase (so validation failures can block the
persistence, instead of setting to error state).

This is part of the effort to separate out L3 validation
and builds upon the reference implementation changes being
reviewed in 102351.

Change-Id: I6040e6d8ab32b707bcf67a0882507b7ee2d4bebe
Partial-Implementation: blueprint l3-svcs-vendor-validation