Adds concept of a primary network interface

[bnaecker]

• Adds the is_primary column to the network_interface table, and a
  corresponding field primary in the database model and external
  NetworkInterface objects. Primary interfaces are used for NAT and
  appear in DNS records.
• Updates the InsertNetworkInterfaceQuery to automatically decide if
  this interface should be considered the primary. It considers the new
  NIC primary iff there are zero existing NICs for the instance it's to
  be attached to. That means that the first NIC added to an instance,
  either during a provision or later, is the primary. Future work could
  allow changing which NIC is the primary.
• Adds a new query for deleting a network interface from an instance,
  with improved validation. This now checks that the instance is stopped
  inside the query, fixing a TOCTOU bug. It also verifies that the
  instance either has exactly 1 interface (which must be the primary) or
  that the instance has 2 or more (we're deleting a secondary). This
  means that the primary interface cannot be deleted until all secondary
  interfaces are deleted. The reason for this restriction is that
  instances must have a primary interface, and it's not clear how to
  pick a new primary from the remaining secondaries if we allow deletion
  of the primary. We force the client to make the choice.
• Adds a special error type for handling the above validation failures.
• Adds tests for this deletion behavior to the instance integration
  tests

[bnaecker]

This is intended to resolve #960.

[smklein]

Looks good! Couple questions, but otherwise LGTM!