RFE: expand sanity script to check consistency for secgroups and with VPP

The sanity script validates etcd against Neutron for port states. It should further check:

- neutron <-> etcd for physnets (reporting available on all agents, that they are all the same, that networks use them exclusively)
- neutron <-> etcd for secgroups (that used secgroups are present and correctly represented in etcd)
- etcd <-> VPP for port states, networks, uplinks, secgroups / ACLs (that VPP config as read idependently by the API or debug CLI is what we would expect given the etcd config)

It should also be easy to understand so that we can encourage future committers to add to it when they add features.