Run nova-api as privileged so it can muck with iptables

Not sure if mucking with iptables is safe, but appears required.

Change-Id: I766b0e61e247c47b4449c1ed2c204ddb8919a87d
Merge "Run nova-api as privileged so it can muck with iptables"