Only cache lookup for *edgeHost address

Because the hostname of the backend server used by the CDNBackendServer
helper tests isn't always "localhost" - it can be ::1 or 127.0.0.1 - which
results in those addresses being resolved to the same as *edgeHost and this
error occurs:

    helpers.go:141: dial tcp 172.16.20.10:8080: connection refused

We could use a more complex map of cached names and addresses. But I think
edgeHost is the only thing we want to cache.
Merge pull request #70 from alphagov/only_cache_edgehost

Only cache lookup for *edgeHost address
Use HTTP/1.0 for Varnish probes without Host

It's not valid for an HTTP/1.1 request to not have a Host header. So we
should downgrade these requests to HTTP/1.0
Merge pull request #71 from alphagov/varnish_probe_http10

Use HTTP/1.0 for Varnish probes without Host
Use httptest.Server.URL in helper tests

Rather than constructing our own `http://localhost` URL. This is in
preparation for enabling TLS backends, which will mean that we can no longer
assume that the scheme is HTTP.

http://golang.org/pkg/net/http/httptest/#Server
Enable TLS on backends by default

So that we can test CDN providers that support this rather than explicitly
disabling their TLS support for backends. It uses a self-signed certificate
that comes with `httptest.Server`.

It can be optionally disabled with a CLI flag. This has been done for the
mock tests in Vagrant and TravisCI because Varnish doesn't support TLS
backends.

I'm not using an existing CDNBackendServer in the new helper tests because
they need to be started with custom options. Whereas I think it's probably
correct for the other helper tests to use originServer, because they ensure
that it's functioning correctly for that run. The `0` port means that the OS
picks an available port at random.

I did consider using stunnel or extra proxying through Nginx in order to
make TLS mandatory. But I think it's probably more work than it's worth
right now.
Support custom TLS certificates

Allow a custom TLS certificate and private key to be passed in as CLI flags.
This will override the httptest.Server default self-signed certificate. It
will come in useful for CDN providers that perform strict checking of origin
certs.

This made me wonder whether we should write some tests to check whether
providers perform strict checking of cert chains and subject names. But
that's out of scope for now.
Remove disableBackendTLS and use stunnel in mocks

Supporting both HTTP and HTTPS backends is going to prove a lot of trouble.
The bug 998d01d was missed because I wasn't able to run all of the tests
locally.

So use stunnel to re-encrypt the request back from Varnish to our test
backend. This should work more-or-less the same as Fastly's TLS support in
Varnish.