use ssh instead of wsh

wsh speaks via sockets, which means that the container must have a socket file
on the outside that it's listening on. this cannot be done securely with
docker volumes; the mount point needs to be writable so the socket can be
created, but then anyone in the container can write outside the host.

instead, maintain a port pool for the host-side ssh port, and each container
runs a (dropbear) ssh server. a keypair is generated for each container, and
the pubkey is authorized via read-only volume mounted to the container's root
and vcap user's .ssh directory.