Add a flag to add a VIP IP for public facing jobs

[dwallraff]

We don't always deploy products (concourse, cloudfoundry) behind a non-bosh managed load balancer. It'd be nice to be able to specify a public VIP for those internet facing jobs (web job in concourse, which I'm told listens on :8080, and HAProxy in cloudfoundry). You'd probably also want to add some logic so someone doesn't attempt to have 3 HAProxies with only 1 VIP, etc.