FWaaS: adding a router port to fwg and removing it leaves the fwg active

[Dr. Jens Harbott]

Steps to reproduce:

- Create a router
- Optionally create a new firewall group (issue also happens when using the default FWG)
- Add a subnet to the router
- Add the router port to the firewall group
- Verify that the status of the firewall group changes from INACTIVE to ACTIVE
- Remove the subnet from the router again

Actual result:

The firewall group has an empty ports list but still has status ACTIVE.

Expected result:

The firewall group has an empty ports list and status INACTIVE.

Tested with devstack on current master. This may be related to https://bugs.launchpad.net/neutron/+bug/1845300 but that one seems to happen only sporadically and also the tempest test actually explictly removes the router ports from the fwg.

[Lars Erik Pedersen (pedersen-larserik)]

I've also observed this behaviour, even without actively adding any ports to the default fwg. It became active when i added a subnet to a router (or, it might've been when the DHCP-agents spawned)

ref. tihs about instance ports https://specs.openstack.org/openstack/neutron-specs/specs/newton/fwaas-api-2.0.html#firewall-groups