Description of problem: Enhance OVN to support match expressions of the form "get_group_id(PG)" where PG is a PortGroup that has been configured with an additional (new) option "use_group_id_metadata". Also add support for match expressions of the form "src_group_id". get_group_id(PG): is a function that can be translated to an ID that maps to PG in the Southbound DB. src_group_id is always populated in a register (in tunnel header as well when sending to remote), if the src port belongs to a group that has "use_group_id_metadata" = True. This will allow CMSs to simplify their network policies and will also generate less openflow rules when used in ACLs such as: match = "outport == @pg_B && src_group_id == get_group_id(pg_A)" action = "allow"/"drop"/etc Limitations: A logical switch port can only be part of at most one Port_Group that has "use_group_id_metadata"=True. Additional info: https://mail.openvswitch.org/pipermail/ovs-discuss/2020-April/049888.html https://mail.openvswitch.org/pipermail/ovs-discuss/2020-April/049932.html