Per-flowspace-entry action slicing

[nbastin]

Need to be able to specify per-flowspace action constraints, along the lines of "this output port can only be used if the packet is on this VLAN", or "this subnet can only be matched on these input ports".