Partial implementation of AC-17 (9) for eNZi

[anweiss]

Active sessions cannot be disconnected from UCP nor DTR. Current workaround is to use host OS firewall or drain/pause a node. Dependent on https://github.com/docker/orca/issues/4020.