SEC-220: actually block /login?next=/favicon.ico

Previously we only blocked exact matches to "next=favicon.ico". Now,
we'll also block "next=/favicon.ico" and any other variations.

playbooks/roles/nginx/templates/edx/app/nginx/sites-available/lms.j2

@@ -166,7 +166,7 @@ error_page {{ k }} {{ v }};
       {% include "basic-auth.j2" %}
     {% endif %}
 
-    if ( $arg_next = "favicon.ico" ) {
+    if ( $arg_next ~* "favicon.ico" ) {
       return 403;
     }