Varnish: don't inadvertently convert 500s to 503s

Currently, when retry5xx is set in the puppet config, we return(restart)
from vcl_fetch() on 500s, to have Varnish retry the request on a
different backend.

However, we have no protection against doing this indefinitely by
checking req.restart, so we end up doing so, and hitting Varnish's
max_restarts loop detection parameter and have the frontend throw its
own cryptic 503 instead of e.g. a backend (either Varnish or MediaWiki)
display its own 500 or 503.

Fix this by guarding the return(restart) with req.restarts, and
hardcoding 4 in the process. We might want to lower this more in the
future (4 retires sounds like a lot) but for now this should do it.

Change-Id: Ibf358a2b3df2e984947347138856c5c7e1b91a5e