new config_sample_php manual page

Eyeballs wanted! This is the authoritative config_sample_php reference so it needs to be good. 

The very last item on the page, Custom CSP policy, needs more explanation. The whole page needs review.

Two items are missing from config_sample_php.rst:
version
instanceid

I tried 'singleuser' => true, and nothing changed. All of my non-admin users could still log in and do stuff.

@PVince81 @danimo @LukasReschke @MTRichards @craigpg 
Add a notice that this will be also enforced via the [HSTS header](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security). Which means that if HTTPS if removed from the webpage later the browser cache needs to be cleared.