Eliminate need for access_compat module in Apache

Remove duplicate when statement in Let's Encrypt task

While adding the Let's Encrypt offline testing block in 1746afcc we
accidentially duplicated a the 'when' statement. Ansible only looks at
the last when statement for a given block meaning the earlier one has no
use. This commit merges both lines in one.

Update testing to work with modularized Sovereign

* Harvest testing configuration into group variables
* Define testing group for Vagrant to use
* Move testing passwords to secrets directory that Vagrant uses
* Update .gitignore to keep the testing secrets

VPN - enforce TLS min version on the client

The directives provided by `mod_access_compat` are deprecated.  This
patch eliminates references to them.

Currently client email is submitted via ssmtp (port 465).  This has been
deprecated for years.  The correct way to submit email is via
submission (port 587).

This patch adds port 587 as a second and the default way of submitting
email for delivery.  Port 465 remains open for backwards compatibility
with existing clients.

Modularize sovereign

Add missing configuration parameter for ircbouncer

DOC: sudo is not installed by default on jessie

news role: add missing restart apache handler

All of the variables need to be set.

See https://docs.ansible.com/ansible/playbooks_lookups.html

Preserve testing.yml

Allows hosts to use vars in `group_vars/sovereign`

Name a module after the software it provides, not the functionality it
provides.  This allows alternative software providing the same
functionality to be located in Sovereign.

Remove unnecessary ownCloud configuration

Add non-interactive to LE client options

Remove unneeded/deprecated apache configuration

Fixed LE renew options

Fix fail2ban dovecot config.

add www.domain DNS entry to README.md

The ownCloud configuration file does not get touched.  The virtual host
configuration is modified by sovereign but can be updated in place and
Apache restarted.

Add leading 0 to octal file permissions

This is done to suppress warnings from ansible-lint.