status checks: put DNSSEC tests in a better order w.r.t. other tests

* If the PRIMARY_HOSTNAME is in a zone with a DS record set at the registrar, show any DNSSEC failure (but only a failure) immediately since it is probably the cause of other DNS errors displayed later.
* For zones, if a DS record is set at the register, do the DNSSEC test first because even the NS test will fail if DNSSEC is improperly configure.
* But if a DS record is not set, the this is just a suggestion to configure DNSSEC so offer the suggestion last --- after mail and web checks.

see https://discourse.mailinabox.email/t/dns-nameserver-gandi-glue-records-issues/105/3
generate the locales before change to it.

For my german box changing the locale failed:
´´´´/bin/sh: warning: setlocale: LC_ALL: cannot change locale (en_US.UTF-8)
/bin/sh: warning: setlocale: LC_ALL: cannot change locale (en_US.UTF-8)
/bin/sh: warning: setlocale: LC_ALL: cannot change locale (en_US.UTF-8)
/bin/sh: warning: setlocale: LC_ALL: cannot change locale (en_US.UTF-8)
setup/functions.sh: line 6: warning: setlocale: LC_ALL: cannot change locale (en_US.UTF-8)´´´´

see #206 and 4e6d572de9c917d5a96b3413923c115ab8fbf7bc
closes #220
commit modified by joshdata
dnssec: use RSASHA256 keys for .email domains
replace '.' with 'source'
remove unnecessary sudos
more work on making the bash scripts readable
remove apache before installing nginx, see #224
since the management server binds to 127.0.0.1, must use that and not 'localhost' to connect to it because 'localhost' resolves to the IPv6 ::1 when it is available, see #224
split external/custom dns into separate pages in the admin
allow overriding the second nameserver with a secondary/slave server

fixes #151
fixes #223
bootstrap: apt was mangling stdin

When executed "cat bootstrap.sh | bash", apt-get mangled stdin. The script would terminate at the end of the if block containing apt-get (that seems to be as much as bash read from the pipe) and the remainder of the script was output to the console. This was very weird.

Ensuring that apt-get and git have their stdins redirected from /dev/null seems to fix the problem.

see #224
backup status relativedelta was displaying wrong for deltas greater than 1 month
status check on ns records should now take into account that secondary dns may be customized, see #223
show SSL certificate expiration info in the control panel even long before certificates expire
handle catastrophically bad certificates rather than raising an exception
control panel tweaks
sort SSHFP records so that DNS updates don't trigger spurrious zone changes
add instructions for static web hosting into the control panel
tweak the new web instructions
in the admin, group users by domain, fixes 209