Add flag to optionally block ec2 metadata proxy

[ElliotGardiner]

Some cluster administrators may not want tenants to be able to access non-iam aspects of the ec2 metadata api (eg; http://169.254.169.254/latest/user-data).

This change continues to route requests through the reverseProxyHandler by default but allows administrators to disable that functionality:

containers:
    - image: jtblin/kube2iam:dev
      name: kube2iam
      args:
      - "--block-ec2-metadata=true"

[coveralls]

Coverage remained the same at 19.946% when pulling d3a16ed on ElliotGardiner:block-ec2-metadata-support into 8dc96cf on jtblin:master.