chore(rootfs): nginx 1.18.0, openssl 1.1.1g

[felixbuenemann]

changes to software versions:

• nginx 1.18.0:
  • removed deprecated ipv6 build flag
  • use optimized cloudflare zlib fork
• openssl 1.1.1g with patches:
  • support ChaChaPoly-1305-Draft cipher used by older Androids
  • support cipher suite priorization for TLS 1.3 in Nginx
  • support equal preference ciphers groups (eg. ChaCha vs. AES, based on BoringSSL)
  • build with weak cipher support to keep 3DES support
• modsecurity 3.0.4
• mod_security_nginx 3.3 + fixes
• owasp_mod_security_crs latest 3.3/dev ruleset
• ngx_http_geoip2_module 3.3

new features available in router:

• tls 1.3 support
• tls 1.3 early data (0-rtt), including mandatory Early-Data request header for apps
• chacha-poly and chacha-poly-draft ciphers
• equal preferemce cipher groups
• advanced cipher suite syntax like @SECLEVEL=n (validation fixes)

changes to router configuration:

• tls 1.3 enabled by default
• tls 1.3 early data enabled by default for GET, HEAD, OPTIONS requests
• equal preference groups for aes128-gcm and chacha-poly in default cipher suite

[felixbuenemann]

I've also pushed an image felixbuenemann/router:git-4bec8bd to Docker Hub for easy testing, it can be used as a drop-in for existing clusters by changing the image in the deis.router deployment.

[Cryptophobia]

@felixbuenemann , if you fix the README markdown tables for the ciphers, we are good to go and I can merge this in before making a new minor release. :)

[felixbuenemann]

README is fixed in 94e77aeb8f9f646ebfb2f26bd72aabc2f8156308, so I think this is good to go from my side.