Update the allowed-address-pairs denial patch for shared-nets

This update will allow the allowed-address-pairs denial patch for the
shared nets to properly allow loadbalancers to update the allowed-address-pairs
on shared-nets (and most specifically the public direct net).

It was added to the puppet-coe-service-patch repo, but it seems it didn't
get entirely frontported. This should finish it off.

Closes-rally-bug: DE646
Not-in-upstream: true