Refactor iptables rule expansion for the non ipset case

Refactor iptables rule expansion for the non ipset case

IptablesFirewallDriver / _select_sg_rules_for_port was
handling the rule expansion for the non ipset case all
inside the same function.

This patch refactors the expansion out, so it will be
more clear, and easier to cut out non-ipset code later
in time.

Partially implements blueprint refactor-iptables-firewall-driver

Change-Id: I4225d233e59da797e9fa1737757d039eb946cba1