Ensure netfilter is enabled for bridges

Ensure netfilter is enabled for bridges

Since security-groups use iptables rules on Linux bridges, we need to
ensure that netfilter is enabled for bridges.  Unfortunately, there
seems to be a long history of distributions having differing defaults
for this, best described in [1].

It seems at the moment everyone has to discover this for themselves;
packstack found it in Ia8c86dcb31810a8d6b133a161388604fde9bead4, then
fuel found the same thing in I8582c24706c3a7253e00569eef275f116d765bca
and then finally someone else hit it and put it into documentation
with I4ed3cec03a1b3a7d56dfe18394154ec1b2db6791.  I just spent a long
time figuring it out too when deploying with devstack.

Rather than having yet another fix in devstack, I don't see why
neutron shouldn't be ensuring the setting is correct when it starts up
-- without these settings enabled, security-groups are silently
broken.  This does that, and modifies test-cases to check we make the
calls.

[1] http://wiki.libvirt.org/page/Net.bridge-nf-call_and_sysctl.conf

Change-Id: If2d316eb8c422dc1e4f34b17a50b93dd72993a99