HAProxy serves its dashboard page

right now only accessible by ip/port
[#73913860]
Advertise route to haproxy dashboard
Copy across mysql_upgrade.sh from compilation vm and pass path to go
process.
Remove networks from template

They should be in stubs.  This was changed a while ago for runtime.
Along with philosophical problems, spiff merge logic is weird.

[#76020370]
Require haproxy_stats_password in the cf-mysql-template