Services v2 (ip-per-service)

DO NOT COMMIT.  Needs test updates and a new e2e test.  Some FIXMEs still.  95% complete.

Add support for IP-per-service behavior.  This creates virtual IP addresses for each service, and uses iptables to route traffic "magically".

The first few commits are relatively independent, and could be extracted to different PRs, if you feel like making me suffer.

See #1107 for background.
You can mark node as a local variable and you should quote it in gcutil.

Kind of nitpicky, but in general, I believe the syntax of `funcname() {...` is preferred for shell (see [here](http://tldp.org/LDP/abs/html/functions.html).)

```shell
ssh-to-node() {
  local node=$1
  shift
  gcutil --log_level=WARNING ssh --ssh_arg "-o Loglevel=quiet" "${node}" "$@"
}
```