Update testing to work with modularized Sovereign

* Harvest testing configuration into group variables
* Define testing group for Vagrant to use
* Move testing passwords to secrets directory that Vagrant uses
* Update .gitignore to keep the testing secrets

VPN - enforce TLS min version on the client

Modularize sovereign

Add missing configuration parameter for ircbouncer

DOC: sudo is not installed by default on jessie

news role: add missing restart apache handler

All of the variables need to be set.

See https://docs.ansible.com/ansible/playbooks_lookups.html

Preserve testing.yml

Allows hosts to use vars in `group_vars/sovereign`

Name a module after the software it provides, not the functionality it
provides.  This allows alternative software providing the same
functionality to be located in Sovereign.

Remove unnecessary ownCloud configuration

Add non-interactive to LE client options

Remove unneeded/deprecated apache configuration

Fixed LE renew options

Fix fail2ban dovecot config.

add www.domain DNS entry to README.md

The ownCloud configuration file does not get touched.  The virtual host
configuration is modified by sovereign but can be updated in place and
Apache restarted.

Add leading 0 to octal file permissions

This is done to suppress warnings from ansible-lint.

Depending on when the client is run, there are no certificates to
update.  By default, the client runs in interactive mode and wants to
notify the user of this.  This causes Ansible to hang waiting for an
acknowledgement that will never come.  Adding the non-interactive flag
fixes this.

Idempotency fixes to LetsEncrypt handling.

Encrypt Postgres passwords, and fix change-reporting.