cfgupgrade: Limit specs in ipolicy are always complete

Partial specs are filled with cluster defaults.

Signed-off-by: Bernardo Dal Seno <bdalseno@google.com>
Reviewed-by: Helga Velroyen <helgav@google.com>