FIPS-ready, A+ configuration per Qualys SSL Labs

cc: @chasballew

Do not merge.

This gets us an A+ rating [on Qualys](https://www.ssllabs.com/ssltest/analyze.html?d=dashboard.aptible.com), plus a "FIPS-ready" grade.

However, this is at the expense of compatibility (see in particular IE 6 / Windows XP). Before we can merge this, we'll need to implement aptible/sweetness#91, allowing users to choose between NGiNX configurations (we can offer two flavors to start — "compatibility" and "FIPS-compliant").

Note that in my current judgment, anyone NOT requiring FIPS compliance should probably not use it. It's less compatible and not necessarily significantly more secure.