Race condition in attaching new network interfaces to an instance

[bnaecker]

When attaching new network interfaces to an instance, we first verify that the instance is stopped. This opens up a race window, as the instance might be started after the check, but before we actually run the query to create / attach the new NIC. The already-complicated InsertNetworkInterfaceQuery may be augmented to do this check itself, or we might make use of the new tools for collection attach, if that's less surgery.

[bnaecker]

Closed by #1222