Filter private addresses when setting up the tunnel

[Vincent Ladeuil]

We currently rely on sshuttle when using canonistack because on some weird issue (elmo had the details, I forgot, sorry) that will be addressed when canonistack migrates to neutron.

In the mean time, seeing a private address (http://en.wikipedia.org/wiki/IP_address#IPv4_private_addresses) for the bootstrap node can be used as a hint that we need to use sshuttle in addition to the .ssh/config stanza making these addresses reachable via chinstrap.

# lcy01 and lcy02
Host 10.55.60.* 10.55.32.*
     User ubuntu
     ProxyCommand ssh chinstrap.canonical.com nc -q0 %h %p

in ~/.ssh/config should also be documented.