add a flag -c whether or not to check the VPN on create

Changed default to no, as the other side may not be up yet.
If this check fails, the VPN enters Error state and will not
work. It's safe to just let it connect on its own so it will
connect when it can.

(cherry picked from commit f8d718e3e31ad517969663d24647fcbd9b50cc3d)
prevent CloudStack from removing the VPN connection

If connecting the VPN takes some time, for example because
the other end is not (yet) up, CloudStack will delete
the VPN because the ipsectunnel.sh does not return in time.
The VPN connection then enters the Error state.

This change makes sure ipsectunnel.sh returns in time,
and lets ipsec connect in the background. If it all fails,
the connection enters Disconnected.

(cherry picked from commit 7f33f7c3969d3b217ad6977f01bb487ebeee665d)
made iptables for the VPN connection more secure

Added destination and source definition. Flag -S can be used
to ignore this. It's the new default as it is more secure
and does not impact the way things work (backwords compatible).

(cherry picked from commit ef3b4bb4e3342f166489034fa7149540d2ef1383)