Update "apt-key" usage to verify the fingerprint

This adds a little extra verification to make the build fail outright if the build server has been the subject of a MITM attack.
Use same symlink logic for stderr as stdout

This simplifies the default command by taking advantage of the default configuration just like the precedent set for access.log.
Simplify default command via PATH and default conf

This makes it simpler for users to supply custom arguments at runtime, since they essentially have to duplicate this default command line to do so.
Add explicit version pinning, for cache-busting

Because Docker uses the exact textual contents of the line for the purposes of the build cache, just doing `apt-get install -y nginx` would never actually update unless the base image itself updates.

This `ENV XYZ_VERSION a.b.c` pattern is one we've had a lot of success with in other docker-library repos (see especially https://github.com/docker-library/postgres for a good example of how this allows us to magnify maintenance ability to span quite a few versions of PostgreSQL concurrently), and most importantly it creates an explicit, context-sensitive cache-bust right where it's needed.
Merge pull request #1 from tianon/minor-tweaks

Minor tweaks