Added 'secret' role and moved site.yml

- 'secret' role allows you to create encrypted storage that can be used
for secure storage of passwords, certificates and other important files.
It replaces and complements old "secret/" directory functionality. More
information can be found in README file in the role subdirectory;

- 'site.yml' (main playbook) has been moved from root of the project to
'playbooks/site.yml' to keep it in line with other playbooks;
Removed old 'secret/' documentation
Added variable to set randomness source (secret)
In 'secret' role, use /dev/random by default
Changed the way 'secret' role checks mount status
Changed tests in 'secret' role

Now 'secret' should correctly close storage if it was opened previously.
Added more cron entries to rsyslog configuration
Added another template to 'ferm' role
Replaced 'sshcerts' role with 'pki' role
Added SSL session settings in nginx configuration
Moved keepalive_timeout setting in nginx

Now keepalive_timeout can be set per server { ... } declaration instead
of globally in http { ... }.
Enabled SSL support in 'nginx'

- by default SSL support is enabled in all nginx servers if private key
  for hosts' FQDN domain is found in '/srv/pki' (see 'pki' role for
  details);

- you can disable SSL support selectively for a server, or disable
  listening on port 80 for a server;

- you can select SSL certificates either directly, or by providing
  a type (normal "certs", "combined" or "selfsigned") and optionally
  domain name (if it's not provided, default FQDN domain is used);
Disabled SSL for Debian Preseed webserver

Currently debian-preseed does not support downloading preseed.cfg over
HTTPS (no openssl and ca-certificates in the installer)
Modified fact gathering in newhost.yml

Now Ansible should not stop with an error if host does not have python
package installed.
Added gnupg-curl to list of default packages

gnupg-curl is needed for GnuPG encrypted keyserver access using hkps://
protocol.
Changed default cipher list in nginx

With this cipher list gnutls-enabled software should work correctly with
websites accessed over HTTPS.
Modified frontend configuration in 'sks' role

Now sks frontend does not automatically redirect from HTTP to HTTPS for
compatibility, also hkp port (11371) is left without redirection.
Small comment clarification in 'monkeysphere'
Reordered roles in common.yml

'pki' role should be run before 'monkeysphere' in case that we use
encrypted GnuPG keyservers (installs openssl support and custom
certificates, among other things).
Added 'etc_services' support in 'nfs' role