Externalized services v2

Uses IPTables on each host node to demux based on destination IP address.

Eliminates service port conflicts.
Idea: What if we just have one Portal IP.  If you set the "createExternalLoadBalancer" flag, the portal IP is a public-compatible IP, else it is a cluster-private IP.

For intra-cluster use, the path is the same:  access the service IP, redirect to kube-proxy, RRLB to backends.

For external use, the path is: access the IP, <LB stuff>, backends.

The <LB stuff> depends on the cloud provider and setup.  In GCE now, it will be GCLB, pick a node, redirect to kube-proxy, RRLB to backends.  If we replace GCLB with HAProxy it would be external IP, HAProxy, backends.

Do we need two IP fields?