Filter out containers with unmapped ports

This bit us when running one-off containers on our docker hosts (to run scripts, debug problems, etc.). Synapse would pick up the container because the image name and the private port matched, but the missing public port would cause it to generate an invalid haproxy config file and crash.

This fixes that by adding a simple check that the public port is present when deciding which containers to consider adding as backends.

It only does this for new-style port mappings because I can't find any docs on what the old-style port mappings looked like in this situation, nor is it clear that you could even prevent an exposed port from being mapped back when that version of the remote API was in use.