Add apache/nginx config to mitigate SA-CORE-2018-002

After moving it to the vhost config this also needs a patch for hosting_https ...

Looks reasonable, but I'm not sure of a good way to test. Would it be hard to add CI tests for both servers?

I'm open to suggestions for a CI test but don't have one ready.

Here's an extra patch for hosting module to re-verify all sites to update their vhost config.

Nginx config has to be moved to the default config include, which is included in every vhost, since "set" directive is not allowed in this context:

Executing: sudo /etc/init.d/nginx reload
  nginx: [emerg] "set" directive is not allowed here in /etc/nginx/conf.d/aegir.conf:243
  nginx: configuration file /etc/nginx/nginx.conf test failed

Here is a working patch for Nginx (attached).

Note that there is no need to re-verify sites hosted in Nginx based Aegir, since the updated (single) config is dynamically included in all vhosts.

thanks @memtkmcc, I've committed that to the 2960825-mitigation branch.

For easy review, here's the full patch.

@memtkmcc so instead of the sites we should verify the server nodes?

I somehow managed to delete the patch from #13 .. here's that again.

And an updated re-verify patch to also do the server.

This was released with 3.14.6 ... it would be nice to improve this (or verify that it already does) cover SA-CORE-2018-004. But lets create a new issue when there is someone available to work on it.

The rules are still present in the nginx templates, so I think the trailing commit for apache should probably be merged in so the configurations are coherent between the two possible webservers. Tested w/ apache2.

I've now committed the changed Jon pointed at.