EUCA-8134: reconfigure haproxy with ssl termination
  1) server certificate's ARN is delivered to servo VMs, which will fetch it using iam:downloadservercertificate
  2) for each new LB, we create an unique role and instance profile.
  3) for each new HTTPS/SSL listener, we put a new IAM policy that
     allows the role to download the server cert. This way, we ensure the server-cert
     will be accessible by a servo VM that's only for a specific loadbalancer.
     This security measure is in addition to using EUARE's token for proving that
     the requester is any servo VM.
  4) Euare's authorization check is slightly modified to accomodate the specifics of server-cert