add remove NAT rules

add support for closePortForwarding for PortForwarderVcloudDirector
refactor VcloudDirectorSubnetTierLiveTest to create a VM for the test
modify NatService: networkId is no more required by the user
I am changing this to throw `IllegalArgumentException` if `publicIp` is not valid, so we'll catch and propagate that in `openPortForwarding`.  For `closePortForwarding`, we'll just do the catch+log.