Say which network policies attach no network device #1001

openvmm_arguments attaches no network device for a policy that denies egress without allow rules, denies ingress and host-loopback access, and has no proxy, and doc/run.md and doc/usage.md call that a policy that lets nothing through.

A policy that denies egress with allow rules that lower to no OpenVMM rule, such as a rule that excepts its whole destination, lets nothing through either, but attaches a network device.

Either name the condition by its options in those documents, or attach no device for such a policy too, which also changes the template key of such a policy.

Found in #958 (a review note on existing behavior, which #958 documents and tests but does not change). Related to #833.