undercloud: network: fix NAT rules and gateway to make VRRP slaves work properly

Three changes are made here:

1. Removal of default "Bocal" gateway on bond0.930: this is useless as keepalived already does this when the node is master, and the route can't be used on backup nodes because it doesn't own expected public IP;
2. New default route to undercloud's internal keepalived IP with metric 50: this route will be used by backup nodes to reach Internet and internal resources, and will be superseded by keepalived's default one on master node
3. Exception on SNAT: do not SNAT traffic inside routing subnet