Bug 1747269

Description of problem:

In LbaaSv2 API, we have vip_address parameter in create loadbalancer API[1].
 [1] https://docs.openstack.org/api-ref/network/v2/#create-a-load-balancer

Using this parameter, user can specify the ip used for vip of their load balancer
instead of getting ip automatically from allocation pool.

The problem is that there are no mechanism about passing this vip_address.

When non-admin user creates a load balancer, they can specify external network
as the network where their LB is listening on, as it is shared and visible,
and also with specifying any address as their vip, which can cause the ip outside
allocation pool can be used.

This causes a very big impact from security point of view, as we do not
expect users to assign a fixed ip in external network instead of getting
it from the range defined by admin

How reproducible:
Always

Steps to Reproduce:
1. Create an external network/subnet by admin, with shared=True
2. Create a load balancer with 
    vip_subnet_id: <external_subnet_id>
    vip_address: <ip_outside_allocation_range>

Actual results:
User can specify fixed vip from external network

Expected results:
User can't specify fixed ip with authorization error.