Harden the edge: catch-all server, modern TLS and HSTS

- Unknown hostnames and direct IP access no longer land on the first
  vhost (Gitea): port 80 closes the connection, except for ACME
  challenges, and port 443 refuses the handshake.
- Mozilla intermediate ciphers (forward secrecy only, no CBC), session
  cache, no session tickets, and HSTS with a short max-age for now.
- Set X-Forwarded-For to the client address instead of appending to
  whatever the client sent.

edge/snippets/proxy.conf

@@ -1,7 +1,9 @@
 proxy_http_version 1.1;
 proxy_set_header Host $host;
 proxy_set_header X-Real-IP $remote_addr;
-proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+# The edge is the first hop, so whatever X-Forwarded-For the client sent is
+# made up: replace it instead of appending to it.
+proxy_set_header X-Forwarded-For $remote_addr;
 proxy_set_header X-Forwarded-Proto $scheme;
 proxy_set_header Upgrade $http_upgrade;
 proxy_set_header Connection $connection_upgrade;