The Ingress namespace/name and UID do not change, so we cannot depend
on those fields alone.

- For each endpoint update, consider an Ingress update.
- For the candidate Ingress, compute the VCL spec.
- Compute a canonical form for VCL specs.
- Compute a hash for a VCL spec.
- The Ingress is updated if the canonical form of its VCL spec is
  not deeply equal to the current VCL spec.
- VCL configs are identified by the hash (in addition to namespace/name
  and UID of the Ingress).

Periodically checks the state of each Varnish instance, and updates
their configurations (for example if they don't have an up-to-date
Ingress configuration).

- Don't keep admin connections open indefinitely -- when needed, open
  a connection, do work, close the connection.
- Don't reload or re-label VCL configs if already loaded or labelled.
- More verbose debug level logging.

Docs are not yet updated in this commit.

Also do some doc fixes while we're here.

- Correctly identify the executable to build and copy.
- Order layers more efficiently (don't repeat commands that rarely
  change and take significant time).

- Standardize for Linux
- Disable cgo.

The build process is run entirely by Docker containers, for more
reliable reproducibility.

make targets for local builds can still be run for developement,
and the check/test targets are only used locally.

- Controller uses varnishapi Admin.Listen to listen for the admin
  connection from varnishd.
- varnishd is invoked with the -M option, to connect to the listen
  port.
- Controller also creates the Varnish secret file, using go crypto/rand.
- So VSM does not have to inspected for the management port and
  location of the secret file.
- The only dependency is varnishapi Admin package, which is limited
  to the CLI network protocol, and requires no native code.