Added a network isolator based on port mapping.

Added a network isolator using port-range based traffic redirection on
Linux.

- Containers are assigned non-ephemeral ports by the scheduler and
  ephemeral ports by the network isolator.

- Virtual ethernet devices and traffic control filters are set up so
  that network traffic in and out of the containers is isolated based on
  the ports assigned to them.

- Containers run inside their own network namespaces with separate
  network stacks, from which per-container network statistics can be
  retrieved.

A joint work with:
- Cong Wang (cwang@twopensource.com)
- Jie Yu (yujie.jay@gmail.com)
- Ian Downes (ian.downes@gmail.com)

Review: https://reviews.apache.org/r/21594