VPNaaS: Enhance error checking on subnet changes

[Paul Michali]

Currently, if the CIDR of a subnet changes, and that subnet is used by VPN, there is no checking performed.

Should add a notification for subnet CIDR changes and either block the change, if in use by VPN service/endpoint group, or to cause a sync operation in VPN so that existing connections are updated (if possible).

I'm not sure which would be better. Need to ensure that we don't disrupt any existing IPSec connections that have not changed.

Need to ensure this supports the new endpoint group capability for VPNaaS, where local subnets are specified in endpoint groups (versus the older method of a sole subnet being associated with a VPN service).

[Paul Michali (pcm)]

The easiest thing is to block the change, which is what is done for delete and other resources, so will likely go with that solution for now.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/238693

[OpenStack Infra (hudson-openstack)]

Change abandoned by Paul Michali (<email address hidden>) on branch: master
Review: https://review.openstack.org/238693
Reason: The subnet CIDR is READ_ONLY, so we don't have to worry about blocking the change, when VPN is using the subnet.

[Paul Michali (pcm)]

Found out that the CIDR for a subnet is read-only, so we don't have to block changes, when the subnet is used by VPNaaS.