Explicitly control nginx dhparams

We want to ensure that any client that falls back to DH gets a
reasonably strong encryption experience. Default for nginx is 1024 bits
which is too weak.
Upgrade SSH module

We want to configure the Ciphers that we use, and that has recently been
added. Yay!
Explicitly choose our allowed SSH ciphers

The symmetric portion of the SSH Transport Protocol (as described in RFC
4253 [1]) has security weaknesses that allowed recovery of up to 32 bits
of plaintext from a block of ciphertext that was encrypted with the
Cipher Block Chaining (CBD) method. New Counter mode algorithms (as
described in RFC4344 [2]) were designed that are not vulnerable to these
types of attacks and these algorithms are now recommended for standard
use.

[1] https://tools.ietf.org/html/rfc4253
[2] https://tools.ietf.org/html/rfc4344
Merge pull request #636 from alphagov/feature/diffie-hellman-bits

Explicitly control nginx dhparams
Merge pull request #642 from alphagov/feature/update-ssh-module

Explicitly choose our allowed SSH ciphers
Add tcpdump to all machines

Because it useful when we are diagnosing network issues.
Merge pull request #643 from alphagov/feature/add-tcpdump

Add tcpdump to all machines
Fix typo: ssl_dharam -> ssl_dhparam
Merge pull request #644 from alphagov/bugfix-ssl-dhparam

Fix typo: ssl_dharam -> ssl_dhparam