Handle multiple external IP addresses per instance

[bnaecker]

We're adding support for Ephemeral IP addresses in #1458, but that's currently limited to one IP address. That's mostly because we're currently abusing the source NAT configuration in OPTE meant for outbound connectivity, as a workaround to implement inbound connectivity. Also, OPTE doesn't have a way to express the IP address(es) used for 1-1 NAT in its API yet. (No issue, add link when that's created.)

This tracks relaxing the limit of 1 external IP address per instance, and passing all those to OPTE. See here for the related source, and here for related discussion.

[bnaecker]

This is behind oxidecomputer/opte#196, which will implement the OPTE API allowing us to express multiple IPs.