nginx-ssl.conf changes were partially incorrect, partial revert of 834c42bc

My own /etc/nginx/nginx.conf was messed up, so what I thought were Ubuntu 14.04 defaults weren't, and we lost the ssl_protocols and ssl_prefer_server_ciphers settings. This puts those back.

https://discourse.mailinabox.email/t/dev-master-version-reported-as-poodle-attack-vulnerable-by-ssllabs/898

let dovecot automatically create mailbox folders rather than doing it manually in the management daemon, fixes #554

Added 'Sent' folder when creating user.

an earlier problem about --upgrade (de34d0d3) seemed to be just a local problem on my box, so going back to unpinned >= requirement specs

https://discourse.mailinabox.email/t/upgrade-to-v0-13b-broke-admin/876

use subresource integrity attributes to guard against CDNs being used as an attack vector; drop external resources that we can't protect this way (fonts); fixes #234

choose the best SSL cert from among the installed certificates; use the server certificate instead of self-signed certificates

For HTTPS for the non-primary domains, instead of selecting an SSL certificate by expecting it to be in a directory named after the domain name (with special-case lookups
for www domains, and reusing the server certificate where possible), now scan all of the certificates that have been installed and just pick the best to use for each domain.

If no certificate is available, don't create a self-signed certificate anymore. This wasn't ever really necessary. Instead just use the server certificate.

let the HSTS header be controlled by the management daemon so some domains can choose to enable preload

Revert two FAIL2BAN SSH jail changes

I propose that the default 600s/10minute find time is a better test duration for this ban. The altered 120s findtime sounds reasonable until you consider that attackers can simply throttle to 3 attempts per minute and never be banned.

The remaining non default jail settings of maxretry = 7 and bantime = 3600 I believe are good.

see #531

warn in status checks if a custom DNS record has been set on a domain that would normally serve web and as a result that domain no longer is serving web

if a custom DNS record exists for a web-serving domain and the record is just the box's IP address, don't skip this domain for serving web

Typo

Change KB to MB due to typo.

Added more bantime and lowered max retry attempts

pin pip versions of email_validator and cryptography so pip doesn't keep reinstalling them each upgrade even if nothing changed (and the ceffi depedency installation can be very slow and is prone to break under low memory)

Fix DKIM validation and spamassassin DNS/Pyzor checks

admin: rename my ajax javascript function to ajax_with_indicator; see https://github.com/JoshData/html5-stub/commit/79c57c23031a1430536e1daa8f0a9f3abd07a633

admin: fix jumpyness when a modal is shown (move overflow-y to body; make the navbar not fixed to top)