Add support for JNLP tunneling and use it for the Mac slaves.

This gets them online again after the hostname change to ci.bazel.build.
diff --git a/jenkins/BUILD b/jenkins/BUILD
index 08f1911..77f65ff 100644
--- a/jenkins/BUILD
+++ b/jenkins/BUILD
@@ -44,6 +44,7 @@
     DARWIN_COUNT,
     num_executors = 1,
     remote_fs = "/Users/ci",
+    tunnel = "master.ci.bazel.io:50000",
 )
 
 # GCE machines
diff --git a/jenkins/build_defs/jenkins_node.bzl b/jenkins/build_defs/jenkins_node.bzl
index ebe0056..31fa3b7 100644
--- a/jenkins/build_defs/jenkins_node.bzl
+++ b/jenkins/build_defs/jenkins_node.bzl
@@ -21,7 +21,7 @@
 
 def jenkins_node(name, remote_fs = "/home/ci", num_executors = 1, mode = "NORMAL",
                  labels = [], docker_base = None, preference = 1,
-                 visibility = None):
+                 visibility = None, tunnel = None):
   """Create a node configuration on Jenkins, with possible docker image.
 
   Args:
@@ -38,6 +38,10 @@
       4, then the second one will be scheduled 4 time more jobs than the first one.
     visibility: rule visibility.
   """
+  if tunnel:
+    tunnel = "<tunnel>%s</tunnel>" % tunnel
+  else:
+    tunnel = ""
   native.genrule(
       name = name,
       cmd = """cat >$@ <<'EOF'
@@ -49,7 +53,7 @@
   <numExecutors>%s</numExecutors>
   <mode>%s</mode>
   <retentionStrategy class="hudson.slaves.RetentionStrategy$$Always"/>
-  <launcher class="hudson.slaves.JNLPLauncher"/>
+  <launcher class="hudson.slaves.JNLPLauncher">%s</launcher>
   <label>%s</label>
   <nodeProperties>
     <jp.ikedam.jenkins.plugins.scoringloadbalancer.preferences.BuildPreferenceNodeProperty plugin="scoring-load-balancer@1.0.1">
@@ -58,7 +62,7 @@
   </nodeProperties>
 </slave>
 EOF
-""" % (name, remote_fs, num_executors, mode, " ".join([name] + labels), preference),
+""" % (name, remote_fs, num_executors, mode, tunnel, " ".join([name] + labels), preference),
       outs = ["nodes/%s/config.xml" % name],
       visibility = visibility,
       )