Turn on r::c::ssl::sni locally for varnishes

This switches the ulsfo caches from r::c::ssl::unified to ::sni
for actual prod traffic flow.  For eqiad/esams, it configures the
::sni -style local nginx service on the cache hosts themselves,
but LVS will still be sending the traffic to the ssl[13]00x
machines at these datacenters instead of the new local ssl
services until further changes are merged.

Change-Id: I24013da78641970733649749b6dd2c5eaf507d8e