Add resource agent for IPSEC tunnels

This adds a simple resource agent that handles ipsec tunnels.

It will associate a given tunnel witha specific VIP, and will put it up
or down depending on the VIP being there or not. This is meant to have a
collocation rule with an IP resource.

Note that the tunnel definition and provisioning is responsibility of
the deployer, this merely tracks the VIP and will make sure that the
tunnel is active/inactive when appropriate.