Move security groups and firewall ops to VirtAPI

This patch moves the following network security-related
methods to VirtAPI:

  security_group_get_by_instance()
  security_group_rule_get_by_security_group()
  provider_fw_rule_get_all()

In order to make this change, the _provider_rules() method
of the FirewallDriver was changed from being a staticmethod
to a regular instance method. All uses of it were in the
context of an actual instance, so I saw no reason to keep
it static, which would have complicated the use of the VirtAPI
methods.

Related to bp:no-db-compute

Change-Id: I260c96b6aa4bbab694b74087f704b6405360b0bf

nova/tests/test_libvirt.py

@@ -3171,6 +3171,7 @@ class IptablesFirewallTestCase(test.TestCase):
                 pass
         self.fake_libvirt_connection = FakeLibvirtDriver()
         self.fw = firewall.IptablesFirewallDriver(
+                      fake.FakeVirtAPI(),
                       get_connection=lambda: self.fake_libvirt_connection)
 
     in_nat_rules = [
@@ -3512,7 +3513,7 @@ class NWFilterTestCase(test.TestCase):
 
         self.fake_libvirt_connection = Mock()
 
-        self.fw = firewall.NWFilterFirewall(
+        self.fw = firewall.NWFilterFirewall(fake.FakeVirtAPI(),
                                          lambda: self.fake_libvirt_connection)
 
     def test_cidr_rule_nwfilter_xml(self):