This was a case of golang's wonderfully confusing nil pointer vs
nil interface.

Feedback on haproxy issue 590 showed a working method after all --
haproxy has a listener for dataplane as a backend, and the listener
executes basic auth. This way, the userlist insecure-password config
can be set from the env variable, passed to the container with the
downward API.

See: https://github.com/haproxy/haproxy/issues/590

Setting a password in haproxy.cfg from an environment variable
apparently doesn't work, see: https://github.com/haproxy/haproxy/issues/590

The idea was to set the password in a Secret, whose value is passed
into the haproxy container as an env variable, using the downward API.
This will have to be redesigned.

For now we use the fixed password, so that further development is not
blocked.

WIP: Service deletion currently not working, and testing is otherwise
incomplete.

WIP -- testing currently incomplete.

WIP: undeployment currently not working correctly.

This introduces moving the port definitions for admin services to
a headless Service -- varnish-ingress-admin in admin-svc.yaml. Services
that implement Ingress with Varnish are identified by this Service:
label app=varnish-ingress and at least the port named varnishadm,
possibly also the admin ports for the haproxy offloader (dataplane
and faccess).

And update the "golden" files for testing generated templates.

- Add a Unix socket listerner for the offloader.
- Use VCL 4.1 (required when Unix sockets are in use).

Starting with a pristine cluster, it initially deploys the controller
and unready Services for Varnish Ingress, and verifies the deployment.

Then each of the examples are deployed, verified, and undeployed.

On exit the Services for Ingress and controller are undeployed,
restoring the pristine state of the cluster.