Currently, there is a single flag COMMON_ENABLE_BASIC_AUTH to decide whether to
enable basic auth in the nginx config.  This change allows to enable basic auth
selectively for individual services.

ECOM-2180

ECOM-2185

changes for ssh

basic play

trying to pull the yaml config template up

basic var refactor

initial working version

templates

WIP toward working deployment of notes

haystack

var refactoring and new tasks

Generalization and code review comments

Maria defaults

Maria defaults, refactor for consistency.

missed rename

var renames

removed stub

refactoring

adding tag task until generalized

adding tagging

Also support updating repositories such as python graders
from xqwatcher/xserver

The nginx configuration was set to pass X-Forwarded-For and related headers
unodified to backend services.
This works fine when nginx is deployed behind another load balancer
(for example ELB), which already properly sets the X-Forwarded-* for headers.

But in simpler deployment scenarios, where nginx is directly facing the end user,
nginx should discard any existing X-Forwarded-For headr and set it to remote IP of the request,
the X-Forwarded-Port header to the nginx server port, and the X-Forwarded-Proto
to the scheme of the current request.

The 'NGINX_SET_X_FORWARDED_HEADERS' is set to False by default, but set to True
in the edx_sandbox playbook, where an additional load balancer in front of nginx
is not usually present.

By setting NGINX_ENABLE_SSL ssl this will be enabled in
the nginx configuration for those roles that support
it, currently just the lms and cms.

To use a custom key/cert set the following vars:

* NGINX_SSL_CERTIFICATE
* NGINX_SSL_KEY

Note that there is only one ssl certificate and key
per nginx install, this is because of the way nginx
is setup (independent of the other roles).

We could enable it for different roles though they would
share the same certificate.

Instead of enabling basic auth per role this makes it
an nginx parameter which makes more sense for sandboxes
and probably other servers where we want basic auth turned on

prefix