adjust sslciphersuite to new recommendations
introduce upload dir for gallery server side uploads
get the decision branch right
disable mod_security for galleries
add upload_dir to open_base_dir if there is one
remove duplicate source entry
fix wrong statement
clean up some possible loops
remove unnecessary fileserver variable (#2460)
introduce logmode feature

We are now able to select how apache should log accesses. These
modes are:

* default: as you would use it
* semianonym: no ips are logged for CustomLog, ErrorLog still logs
              ips
* anonym: no ips are logged for CustomLog, ErrorLog is sent to
          /dev/null
* nologs: all logs are sent to /dev/null
only include noip logging if we actually need it
only manage source or content if file should be present
remove unnecessary fileserver variable (#2460) round II
use default logpath as redirects usually don't have a root path
impelement itk plus mode

itk plus mode is an additional mode to deploy itk based hostings
which should be a bit more performant. The idea is that we have
two apache-instances running:

 A) prefork based, listening on the external interface
 B) itk based, listening on the loopback interface

A) will serve all static webpages, as well as possibly serve all static
   content of dynamic websites. All requests to dynamic content will be
   redirected to B). The idea is that A) doesn't load any modules to server
   dynamic content at all.
B) will serve all the dynamic scripts of a vhost.

This will mean that for vhosts (static ones) as well as static content (all
none dynamic scripts) we can benefit from the fast prefork model, while we
can use itk's security model for all the dynamic scripts.

There are two new additional run_modes:

- proxy-itk: this just passes all requests to apache instance B). This one
             is similar to plain itk based mode and should be used for vhosts
             that shouldn't (yet) changed to the mixed mode.
- static-itk: this passes only requests to dynamic scripts to B) while all
              static content is served by A). Beware that the user with which
              A) is running should be member of the run group of B) and all
              static files need to readable by the group. This reduces
              the security model you have with plain itk, as the prefork
              apache user will be able to read php (config-) files of any
              vhost that runs in static-itk mode. If you want to keep
              the level of security for a certain vhost, you need to run
              the specific vhost in proxy-itk mode.

Note 1: you cannot run vhosts in itk mode and others in proxy or static
        itk mode. There is a duplicate file resource definition that
        blocks that possibility.
Note 2: This mode works currently only on CentOS based systems, as no
        work have been done so far to implement an init.d script that's
        able to run 2 apache instances.
fix wrong param naming
only set source or content when we actually manage the file
fix various missing things for itk_plus mode
automatically include php for php vhosts
improve vhosts stuff

- move various inclusion to the file define, as this is the last
  define for all in the chain
- only include if our vhost is not set to absent