Support on-demand headnode network assignment

[henn]

Pre-allocation (pre-creating all the bridges on the HaaS headnode host) is currently-supported and easier to reason about than on-demand creation, and allows HaaS to be run as an unprivileged user. But it also causes some limitations. For instance, because of this, headnodes can only be connected to networks with allocated VLANs. The bridges must also be pre-allocated again on each boot

[henn]

Would be solved by #347. Need to evaluate whether that's the only way we want to address this.