Improve TLS config

[Darkspirit]

#973 (comment)

iirc last time I made this change I broke our buildbot CI completely. This will need to wait until I see convincing evidence that that won't happen again.

Do you mean #913 (comment)?
You broke it under stress without further notice. :-/
It was like changing http://example.com:80/ to https://example.com:80/.
HTTPS is only configured on nginx port 443.

In particular, I believe that there are some python-based HTTP requests for build.servo.org that see a 301 response and raise an exception.

As far as I can see port 80 is only used by web UI. If the transition is done, port 80 can anyway be closed, so I didn't touch it.

• Improve TLS config #913 (comment): Github webhooks connect to plaintext port http://build.servo.org:9010/. This PR additionally introduces https://build.servo.org/github-buildbot-webhook/. Github can later be changed to use it.
• This PR removes the Travis webhook like it was done for other repos.

• saltfs/buildbot/master/files/config/master.cfg

  Line 188 in 8370c39

  c['buildbotURL'] = "http://build.servo.org/"

  This URL is for example returned by the JSON API: https://build.servo.org/json?as_text=1 I did not find other usage. [1] [2] This PR changes it to https.

• saltfs/homu/files/cfg.toml

  Line 226 in 6de0042

  url = "http://build.servo.org"

  This is for links to linux-rel-css & linux-rel-wpt on Github comments. Example: Use tasks instead of events servo#23900 (comment) This PR changes it to https. Web browsers already upgrade to HTTPS due to HSTS preloading.
• https://github.com/servo/buildbotstatus/blob/fee4a03826be878edab409b0ac779f97751a6fd9/app/scripts/config.js#L1 Buildbotstatus already uses Buildbot's https JSON API.
• https://github.com/servo/servo/blob/f1dd31f70440fa9c7a40525bd1e03eede568f74d/etc/ci/performance/download_buildbot_timings.py#L27 Buildbot timings are downloaded via https.
• https://github.com/servo/servo/blob/510ffde3f18d02f19be1e90baa903239922a8e49/python/servo/testing_commands.py#L511 Intermittent tracker is already used via https.
• Other services are directly accessed on their own plaintext port. Mostly on localhost.
• Outdated nginx 1.10.3 is used on this Ubuntu 16.04 server. TLS 1.3 is not supported.

---

This change is