Services v2 (ip-per-service)

DO NOT COMMIT.  Needs test updates and a new e2e test.  Some FIXMEs still.  95% complete.

Add support for IP-per-service behavior.  This creates virtual IP addresses for each service, and uses iptables to route traffic "magically".

The first few commits are relatively independent, and could be extracted to different PRs, if you feel like making me suffer.

See #1107 for background.
(to answer thockin's question)

.. because the port in the variable name is the container port you're trying to refer to, and the value of the variable is the mapped host port.  This makes little sense in kubernetes where the service port is the only known value.

As an example, consider a web server available on host port 8080.  It probably points at docker containers running apache (or whatever) on container port 80.  So to refer to this service using a regular docker link setup (not kubernetes services), you would find APACHE_PORT_80_TCP_PORT had value 8080.