Netfilter version 3

This is a complete rewrite of netfilter.

Collector now compiles a list of netfilter commands for each HVA and sends them over. HVA does nothing more than pass these commands to the shell.

Collector does this in two places.
  * Scheduler: When scheduling an instance, collector will tell the scheduled HVA to apply rules for the incoming instance and tell all other affected HVAs to apply rules for isolation etc. Since this happens during scheduling, netfilter rules are now applied before the actual instances come up.
  * SGHandler: This is a new node module in the collector that processes changes made related to netfilter. It does everything except for initializing vnics. That's done by the scheduler.

Because collector now handles netfilter, there is a new option in dcmgr.conf for it. The sg-implementation option decides what implementation of security groups the collector will use. Right now there are only two options.
  * sg-implementation 'netfilter'
  * sg-implementation 'off'

The default value is 'netfilter'. This value will be used when sg-implementation is not written in dcmgr.conf.
There is an rspec based unit test suite for this. Run it with the following commands

    cd /path/to/wakame-vdc/dcmgr
    bundle exec rake spec