VPN - enforce TLS min version on the client

The directives provided by `mod_access_compat` are deprecated.  This
patch eliminates references to them.

Currently client email is submitted via ssmtp (port 465).  This has been
deprecated for years.  The correct way to submit email is via
submission (port 587).

This patch adds port 587 as a second and the default way of submitting
email for delivery.  Port 465 remains open for backwards compatibility
with existing clients.

Modularize sovereign

Add missing configuration parameter for ircbouncer

DOC: sudo is not installed by default on jessie

news role: add missing restart apache handler

All of the variables need to be set.

See https://docs.ansible.com/ansible/playbooks_lookups.html

Preserve testing.yml

Allows hosts to use vars in `group_vars/sovereign`

Name a module after the software it provides, not the functionality it
provides.  This allows alternative software providing the same
functionality to be located in Sovereign.

Remove unnecessary ownCloud configuration

Add non-interactive to LE client options

Remove unneeded/deprecated apache configuration

Fixed LE renew options

Fix fail2ban dovecot config.

add www.domain DNS entry to README.md

The ownCloud configuration file does not get touched.  The virtual host
configuration is modified by sovereign but can be updated in place and
Apache restarted.

Add leading 0 to octal file permissions

This is done to suppress warnings from ansible-lint.

Depending on when the client is run, there are no certificates to
update.  By default, the client runs in interactive mode and wants to
notify the user of this.  This causes Ansible to hang waiting for an
acknowledgement that will never come.  Adding the non-interactive flag
fixes this.

Idempotency fixes to LetsEncrypt handling.

Encrypt Postgres passwords, and fix change-reporting.