Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Restrict Azure NSG rules to allow external access only to load balancer IP

**What this PR does / why we need it**: On Azure, we create NSG (Network Security Group) rules on the vnet to allow external clients to access services exposed as type LoadBalancer.  At the moment, these rules have a destination of `Any`, which means that they will permit requests on the opened port to any IP within the vnet.  This PR restricts the security rules so that they admit external access only to the load balancer IP.

**Which issue this PR fixes**: None in upstream - reported as https://github.com/Azure/acs-engine/issues/1619 

**Special notes for your reviewer**: None

**Release note**: 

```release-note
Azure NSG rules for services exposed via external load balancer 
now limit the destination IP address to the relevant front end load 
balancer IP.
```