apply network privilege to workspace

[sei-jmattson]

Users can only change a vm's network to networks defined in its workspace.
Creators and Admins can also change a vm's network to globally defined nets, like bridge-net or license-net, etc.

Proposing to shift the privilege from a user role to a workspace property. That will ease the administrative burden of vetting those who should and should not have access to special nets.

Workspaces created by a Creator or Admin could have the net-privs property set automatically.