DRY in openvpn role and allow other rc.local tasks

Update ansible in jessie

The ``sudo`` and ``sudo_user`` directives are replaced with ``become``
and ``become_user`` in Ansible 1.9.

Ansible 1.9 or greater is required.

Let's Encrypt support

Fix travis build by fixing ansible-lint version

Before sudo rule merge
https://github.com/willthames/ansible-lint/pull/96

* Add test-requirements.txt
* travis: enable cache for pip packages

The installer automatically updates itself, which registers as a change
in the git repo.  To maintain idempotency of the task list, the repo
download must be forced.

- Remove unnecessary dependencies
- Clean up postgresql server setup
- Install from official package repository
- Expect package installer to enable modules that are needed
- Update virtual host config with owncloud 8.2 configuration
- Update post-deploy instructions

Fix opendmarc installation

Fix Apache's configuration for version 2.4.8 and above.  See
https://community.letsencrypt.org/t/untrusted-on-mobile-newbe/7903

Don't copy the LE certificates.  Instead use the ssl-cert group to
manage access to the LE certificates directly.  See
https://github.com/letsencrypt/letsencrypt/issues/1425 for a request to
have the LE client do this itself.

Let's Encrypt uses DNS to verify domain ownership, so DNS records must
be set up before the paybook is run the first time.

This method uses Subjective Alternative Names (SANs) to get one
certificate for all the subdomains that Sovereign employs, whether or
not the user configured their site with the roles.

This patch restores sovereign's configuration of opendmarc.

An earlier commit started transitioning opendmarc to use postgres, but
this was incomplete.  This patch reverts that change and uses mysql for
the reporting database.

Other changes:

* Do not maintain a copy of the database import schema.  A copy is
  included in the distribution in /usr/share/doc, so that is used
  instead.
* The configuration file is replaced with the distribution's sample
  configuration.  A second patch will restore the actual configuration.
  This will make the changes easier to see if the default configuraton
  file changes in future versions of opendmarc.

Remove references to Trusty and Wheezy (jessie)

Fix systemd configuration of OpenVPN server

The server was not starting.  As a result, the dnsmasq service failed to
start, and the playbook thus failed to run when using the vpn role.
This patch corrects the configuration per instructions from
https://help.ubuntu.com/community/OpenVPN.

OpenVPN PAM configuration moved up to reduce server bouncing as the
playbook runs.  The dependency on service (re)starts between openvpn and
dnsmasq works but feels brittle.

Roundcube is not available on Jessie except in backports.  This role is
also out of date and needs reviewed and updated for the release included
in backports.  Roundcube could alternatively be installed from source as
recommended by the maintainers.

Make a clean distinction between Debian 7 and Debian 8.  Anticipate the
next Ubuntu LTS release (Xenial) that is planned for support.

Update rspamd repository to the official one.

Set opendmarc password in testing.

Fix znc configuration

Correct typo

Upgrade to cgit 0.12 and gitolite 3.6.4

Clean up Apache SSL configuration

Fix version of tomcat

The znc package installs the client but does not set it up as a
service.  This patch restores the service configuration that
was done on wheezy/trusty.

Take changes to the tomcat6 default configuration and apply to tomcat7
configuration.  This was done by review of the diff between sovereign's
tomcat6 configuration and the default tomcat7 configuration.