secondary NS status checks in 3b91bc2c should not be skipped if the target IP address has been modified by a custom record

see #582

bump HTML5_Notifier version, include its version in the check for whether we need to update Roundcube

Merge branch 'patch-1' of https://github.com/Hoekynl/mailinabox

Added wosign as a suggested free SSL provider.

Update z-push to latest version

For a new user create the archive folder

nginx-ssl.conf changes were partially incorrect, partial revert of 834c42bc

My own /etc/nginx/nginx.conf was messed up, so what I thought were Ubuntu 14.04 defaults weren't, and we lost the ssl_protocols and ssl_prefer_server_ciphers settings. This puts those back.

https://discourse.mailinabox.email/t/dev-master-version-reported-as-poodle-attack-vulnerable-by-ssllabs/898

let dovecot automatically create mailbox folders rather than doing it manually in the management daemon, fixes #554

Added 'Sent' folder when creating user.

an earlier problem about --upgrade (de34d0d3) seemed to be just a local problem on my box, so going back to unpinned >= requirement specs

https://discourse.mailinabox.email/t/upgrade-to-v0-13b-broke-admin/876

use subresource integrity attributes to guard against CDNs being used as an attack vector; drop external resources that we can't protect this way (fonts); fixes #234

choose the best SSL cert from among the installed certificates; use the server certificate instead of self-signed certificates

For HTTPS for the non-primary domains, instead of selecting an SSL certificate by expecting it to be in a directory named after the domain name (with special-case lookups
for www domains, and reusing the server certificate where possible), now scan all of the certificates that have been installed and just pick the best to use for each domain.

If no certificate is available, don't create a self-signed certificate anymore. This wasn't ever really necessary. Instead just use the server certificate.

let the HSTS header be controlled by the management daemon so some domains can choose to enable preload

Revert two FAIL2BAN SSH jail changes

I propose that the default 600s/10minute find time is a better test duration for this ban. The altered 120s findtime sounds reasonable until you consider that attackers can simply throttle to 3 attempts per minute and never be banned.

The remaining non default jail settings of maxretry = 7 and bantime = 3600 I believe are good.

see #531

Removed :$HTML5_NOTIFIER_VERSION, which breaks it

Added HTML5_NOTIFIER_VERSION
Updated git_clone to work.

Tested and working.

Include the roundcube plugin html_notifier by default