same as psk-pluto-01 but with netkey on all ends, also we are now using a
virtual_private where we exclude a /24 and include a /16.  The roadwarrior
connects from the /24 but since there is no NAT, and no virtual ip,
the  %no should be picked and the connection should _not_ get rejected.

The router "nic" SHOULD be enabling NAT.

This is the same test as netkey-psk-vhost-02, except the leftsubnet=vhost line has
the %no and %priv arguments swapped.

road connects to east in this test.