New Parsoid Varnish puppetization

Not applied yet in site.pp, and won't work out of the box on celsus
and constable (pmtpa hosts) until we get SSDs there (if we even do
that; it's Tampa so who cares)

Also adds a VCL with some support for simple purging and implicit cache refreshes.
Since this is a private service where we have full control over all requests
we don't need to restrict purge access at all.

See
http://www.mediawiki.org/wiki/Parsoid/Minimal_performance_strategy_for_July_release
and
https://gerrit.wikimedia.org/r/gitweb?p=mediawiki/extensions/Parsoid.git;a=tree;f=php
for some background.

Co-authored-by: Gabriel Wicke <gwicke@wikimedia.org>
Change-Id: Ic378854f9ad305ff6cacdc2ef0844a3a1d294660