When a VPN wanted to add some routes (like the host route for the
VPN gateway) it would add them itself and listen for parent device
events and re-add them if necessary.  That's pretty fragile, plus
the platform blows away routes that aren't part of the IP config
that's getting applied.

So we might as well just have the VPN connection tell the parent
what the routes are, and have the parent device handle updating
the routing.  The routes are through the parent device anyway,
and so are "owned" by the parent too.