Simplify join to rbac_entries for subnets

Simplify join to rbac_entries for subnets

The subnet table was joined to the rbac table via an association proxy
which required a bunch of hacking in the model_query setup to get it
to work right.

This patch simplifies it quiet a bit by just using a direct relationship
between the subnets and networkrbacs tables joined via the subnet's
networkid.

It also unrolls an API test that was really difficult to debug because
it was hard to tell which iteration it was on.

Change-Id: I4da85218158aae624835b97053da9fbb6fb154ef