bundles/nginx: add a default security.txt to all vhosts

bundles/nginx/files/security.txt

@@ -0,0 +1,9 @@
+Contact: ${vhost.get('contact', repo.libs.defaults.security_email)}
+Expires: ${vhost.get('expires', expiry)}
+Preferred-Languages: ${','.join(sorted(vhost.get('lang', repo.libs.defaults.security_lang)))}
+Canonical: ${proto}://${domain}/.well-known/security.txt
+% for key, value in sorted(vhost.items()):
+%  if key[0].isupper():
+${key}: ${value}
+%  endif
+% endfor

bundles/nginx/files/site_template

@@ -72,6 +72,12 @@ server {
         alias /var/lib/dehydrated/acme-challenges/;
     }
 
+% if security_txt:
+    location = /.well-known/security.txt {
+        alias /etc/nginx/security.txt.d/${vhost};
+    }
+% endif
+
 % if proxy:
 %     for location, options in proxy.items():
     location ${location} {