Assign local VLANs before port filters

Assign local VLANs ahead of establishing port filters so that
actions for OVS flows for security group rules can be appropriately
determined.

Provisioning cannot occur before security group port filters are in
place (connectivity would be established without security!). Also,
assignment must occur before security group port filters are in place
(firewall has to use the local vlan to forward the packet). Thus, the
correct order is to assign, secure, and then provision.

Change-Id: I18f585afc4a342ce97033021a3c3dfb1776695ba
Partially-implements: blueprint ovs-firewall-driver