Proposal: provide the ability to black list IP address ranges

This is to address the common issue of Docker environments needing to communicate with other private networks and avoiding IP addressing conflicts.

The current IPAM driver allows you to specify IP subnets, etc to use for Docker networks, however in a continuous delivery use case where agents running Docker may spin up many different multi container Docker environments, it is difficult to use IPAM for this use case (you end up having to trying to ensure unique IP address ranges for each environment that may run on a single Docker Host - in the event you have different environments attempting to use the same IP subnet, you get failures).

For this scenario, it would be much better to be able to black list specific IP address ranges (to ensure connectivity to other private networks) and allow Docker to choose an appropriate IP address range from the remaining "white listed" address space.

Start by examining the current IPAM driver and Docker network address-allocation flow. The issue does not name specific files or tests, so first locate the code that selects subnets for new networks. Done should allow configured private IP ranges to be excluded while selecting an available range from the remaining address space.