The entrypoint of the haproxy container is an exec
script that sets the password from a template for
haproxy.cfg. Setting the password from an env
variable has proven to be too unreliable.

Also, listening at a UDS does not appear to be
working at all. So the dataplane API listens directly
at the container port (no intervening haproxy
frontend).

This change makes the container more friendly to
read-only filesystems, since haproxy.cfg is now no
longer modified in /etc, but rather in the ephemeral
file system at /run (== /var/run).