The shutdown value of the --block-device parameter was stated to
to be either 'remove' or 'preserve' but the code only coverted
everything to False that was not equal to 'remove'.
This patch adds strict validation that rejects values other than
'remove' or 'preserve'.
Closes-bug: #1558157
Change-Id: I89a6c4fe90ec4d8155f4a7b93006d1972654a223