Allow security groups to pass on NSX-T

This is the second commit to enable CF foundations using the NSX-T
container plugin (NCP) to pass the security groups test.

Specifically, it accommodates NSX-T's behavior of notifying the
container that the host is unreachable (by proactively sending ICMP host
unreachable packets) rather than the "normal" behavior of simply
allowing connection attempts to time out.

<https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol#Destination_unreachable>

Note that NSX-T only manifests this behavior for IP pools which it
manages, not for the internet at large.

Signed-off-by: Rowan Jacobs <rojacobs@pivotal.io>

tasks/task.go

@@ -349,7 +349,7 @@ exit 1`
 					appLogs := logs.Tail(Config.GetUseLogCache(), appName).Wait()
 					Expect(appLogs).To(Exit(0))
 					return string(appLogs.Out.Contents())
-				}, Config.CfPushTimeoutDuration()).Should(ContainSubstring("Connection timed out"), "ASG configured to allow connection to the private IP but the app is still refused by private ip")
+				}, Config.CfPushTimeoutDuration()).Should(MatchRegexp("Connection timed out|No route to host"), "ASG configured to allow connection to the private IP but the app is still refused by private ip")
 
 				close(done)
 			}, 30*60 /* <-- overall spec timeout in seconds */)