networking mapping

We need to be able to map an existing vSphere level network into `docker network` so that we can explicitly provide a container with a route to the outside world, that is not via the VCH appliance.

This likely has two stages:
1. map the network such that `docker create -net=...` can reference it - this starts with vic-machine
2. add firewall rules such that only exposed ports are accessible
