Add support for private only Fargate clusters

Currently when running in Fargate mode the scheduler and workers must be issued a public IP address.

This is due to a limitation in AWS where Fargate is unable to pull docker images without external networking. Having a public IP provides this networking.

An alternative would be to have a NAT gateway in the VPC subnets used by Fargate which will handle the internet traffic. Some users may have one already if they are using an existing VPC.

This needs some thought.