Reach node via .Status.HostIP rather than .Name

Previously, k8s assumed node.Name was either a literal IP or a name in
DNS.  This change uses Status.HostIP (originally from cloudprovider
IPAddress()) instead, since we know that is routable.
Avoid race between image pull and garbage collect

The locks were grabbed at too-low a layer in the callstack, leaving
a (narrow) window where images could be pulled and then garbage
collected before being used.

This change acquires the pullLock a layer higher in the call stack so
the critical regions encompass the entire find+delete and pull+use
operation in both cases.  It also holds pullLock while pulling regular
container images, not just the network container.
Reauthenticate to OpenStack periodically

It appears that gophercloud's "AllowReauth" AuthOption doesn't actually
do anything, and the keystone/auth token is never refreshed.  Eventually
it expires and all OpenStack calls receive HTTP 401 responses.

This change reauthenticates every time the Instances() or
TCPLoadBalancer() API object is requested.  This is more frequently than
required, but exposing token expiry information will require gophercloud
surgery.