This allows a container to run within the same networking namespace as
the host. This will be locked down by default using a flag on the master
and nodes (similar to how privileged is handled today).
In v1b1 and v1b2 we choose the "first defined port" if you do not specify a
ContainerPort. I am proposing that v1b3 just assume the ContainerPort is the
same as the service port unless explicitly provided. This leaves named ports
for now, but that is under discussion on its own.
This is strictly compatible, though to implement this we have to leave the
internal objects with the looser behavior until v1b[12] die. This also adds a
link dependency so that when we DO kill v1b[12] the endpoints controller will
blow up, prompting a fix.