fix NFV tests to include rate_limiter
new rate_limited test
[neutron] Move tunnel and QoS into binding:profile

Move parameters from binding:vif_details into binding:profile. This
makes life easier for the Neutron administrator because
binding:profile can be updated at any time using 'neutron
port-update'. (vif_details is read-only to the administrator.) This
means that features like tunneling can be enabled/disabled dynamically
at any time.

The tunnel parameters are moved as-is.

Bandwidth rate limits are now specified with a specific
'rx_police_gbps' parameter. If this is specified then a strict rate
limit will be enforced at the given rate. This feature is orthogonal
to the vif_details.zone_gbps parameter, which does not represent a
strict limit (and is mostly used to share load across physical ports).
Merge Javier's rate_limiter fixes with the binding.profile branch.

Resolved conflict that binding.profile branch moved the rate limiter
configuration into a separate 'rx_police_gbps' paramter.
first draft of stateful filters
implement CLOCK_MONOTONIC_COARSE for fast time-checking
use simple old/new/swap expiration algorithm
named conntrack module
external tracking code runs, yet to see what it's tracking
cleaner & thinner conntrack api
missing commas
conntrack: display a dump of all connections tracked
setting the other half of conntrack for test
use inet_ntop() instead of ugly string:format()
document conntrack API