Services v2 (ip-per-service)

DO NOT COMMIT.  Needs test updates and a new e2e test.  Some FIXMEs still.  95% complete.

Add support for IP-per-service behavior.  This creates virtual IP addresses for each service, and uses iptables to route traffic "magically".

The first few commits are relatively independent, and could be extracted to different PRs, if you feel like making me suffer.

See #1107 for background.
Looking at your usage below, one other option is:

```shell
ssh-to-node() {
  local node=$1
  local cmd=$2
  gcutil --log_level=WARNING ssh --ssh_arg "-o Loglevel=quiet" "${node}" sh -c "${cmd}"
}
```

And then the shell on the other side of ssh will do word splitting of the second parameter, in which case most of usage of ssh-to-node will be consistent with how you have it and also compatible with the vagrant implementation of it...