Verify ASN in SecurityGroup extended community

Motivation:

In multi-cluster scenario each VNC allocates security group ids locally.
This is problematic because an id from one cluster is meaningless in the
other clusters. A mechanism to assign globally significant ids is needed.
Further, the control nodes need some logic to distinugiush between local
and global ids.

Solution:

Assume an API to assign a global id to a security group.  Global ids are
assigned from a pre-decided range which does not overlap with local ids.

Control node advertises both local and global ids using the SecurityGroup
extended community.  When a SecurityGroup community is received, Control
node ignores it if the ASN is different than it's local ASN. An exception
is made for the case where the id belongs to the global range.

Outstanding:

API server and schema transformer changes to assign global id to security
group.

Misc:

Clean up a few mock agent APIs.

Change-Id: Ibc8d555ebfc80227b1848fbe1eb5dee7d63be19a
Partial-Bug: 1381145