Security Group rule validation for ICMP rules

Currently there is no validation in Security Group rules
when an ICMP rule is added with icmp code alone. A rule
is getting added but there is a mismatch between SG rules
and the corresponding iptables rule that is added.
This patch does the necessary validation on the input.

Closes-Bug: #1301838
Change-Id: I510abac4c426f68ea57c99a5fef3da4058f88797
(cherry picked from commit 7607e3da884551e5c4cfe49de390afbddbb2a9b3)
Raise exception for network delete with subnets presents

N1kv plugin should raise an exception during network delete
if there is a subnet that is tied to that network.

Also changed the order of the assert arguments since now
it's encoraged to have <expected_value, actual_value>.

PLEASE NOTE:
This is a port to icehouse branch. It looks like there are extra test
cases not relevant to the fix. However, they are need it because:
- the code I've commited in delete_network() changes the behavior and
  it'll fail when we try to delete a network if there are subnets on it.
- hence all the test cases which tries to delete a network and don't
  delete the subnets first, will fail.
- Hence ALL the test cases in test_db_plugin.py file which does that
  (deleting the network without deleting the subnet first), needs to
  be overriding and this is why you see all these test cases which
  seems to not be related with the diffs in n1kv_neutron_plugin.py
  file but they are actually very related.

Conflicts:
	neutron/tests/unit/cisco/n1kv/test_n1kv_plugin.py

Closes-Bug: 1336107
(cherry picked from commit 89fb8b633b1ae34d0b56d73ee115462f4acc9540)
Change-Id: I92f177af0e2a2fbc460e0d668989ce590b7d1cb2
Merge "Security Group rule validation for ICMP rules" into stable/icehouse
Merge "Raise exception for network delete with subnets presents" into stable/icehouse