Iptables functional tests fail on Xenial and other newer kernels if
br_netfilter kernel module is not loaded, in which case sysctl knobs to
enable bridge firewalling are not available, and attempt to set them
with _enable_netfilter_for_bridges fails.
We should load the kernel module before running those tests. Luckily,
devstack has a function for just that (plus more).
Change-Id: I602d8cd02c73b18e9d719b19998e36059ae28cd8
Depends-On: Id6bfd9595f0772a63d1096ef83ebbb6cd630fafd
Related-Bug: #1622914