First features

Basic compliance-required configuration for global nginx config.

Note #1: We still require loaiton-based config overlays (if possible) + confirmed tests
Note #2: Some of the requirements rquire review, as their value or even approach doesn't seem to fit wider expectations. Profiles may be a way around this, wider defaults another, a limited default with explicit mentioning is also possible. We have to figure it out before rounding this up

This commit is complete to get us started.