Improve nginx configuration security

To address from #17 (closed):

• GHT-003 Outdated TLS support: https://www.ssllabs.com/ssltest/analyze.html?d=learn.totem%2dproject.org&latest

  • The server supports TLS 1.0 and 1.1, support for this should be removed.
    • Check https://ssl-config.mozilla.org/ for a secure nginx config

• GHT-014 Django interface should be behind firewall https://code.greenhost.net/greenhost/ansible/-/issues/163

  • learn.totem-project.org/admin should only be available from certain IP addresses

• GHT-017 -- when applying better nginx configuration for GHT-003 make sure not to support Cipher Block Chaining (CBC) encryption. (not sure if this is currently still the case)

• GHT-018 Insufficient content sniffing protection #33 (closed)(?)

  • Ensure that responses contain a X-Content-Type-Options HTTP header with the value nosnifff

Header improvements:

• Add HSTS header to nginx configuration (probably with Tutor plugin)
• Add X-Content-Type-Options header (If possible with edx)
• Add X-XSS-Protection header (if possible with edx)
  • Ensure that responses contain a X-XSS-Protection HTTP header with the value 1; mode=block

And unless it's fixed in greenhost/ansible#163, we also need to address: