Split UAA traffic to separate (new) routers

[cweibel]

Changes proposed in this pull request:

• This adds ops files and scaling changes to support adding a new instance group called router-main which are a functional duplicate of the existing router instance group
• By leveraging a new vm_extension defined in the cloud-config the new router-main vms are added as load balancer targets to the already existing uaa load balancer
• During roll out to CF (production and staging) the uaa load balancer will be active in both router vm_extensions. Post deployment of CF, the cg-provision jobs in concourse will be run for staging and production to roll out the changes to the list of load balancers defined in the vm_extensions and then a second deploy of BOSH/CF for each environment. This should prevent any sort of outage seen by customers attempting to hit UAA.

security considerations

This will allow additional WAF rules to be put in place in front of UAA that we cannot currently do because the apps are part of the same vm_extension used by the routers.

[soutenniza]

LGTM