Use a middleware function for middleware config

Rather than exporting an object which then has to be added to app.locals
manually we simply export the middleware config as another piece of
middlware, which can then augments app.locals itself.

This has the added benefit of being able to do further configuration
beyond template locals if necessary.

I've also taken this opportunity to remove the dependency on the
'version' module, which was only being used here.
Move duplicated locals into config middleware
Move template config into a separate module

This configuration is duplicated between the hosting and instance apps,
so it makes sense to move it all into one place.
Make route middleware an actual piece of middleware
Prevent mixed content warnings from font loading
Add secure middleware to redirect to https

Piece of middleware that will redirect all non-api urls to https.

We're skipping the API urls for now so that backwards compatibility is
preserved for those that are currently using the API. The API is still
available over https, though.
Add force_https config variable

This defaults to false but when set to true the secure middleware is
used which redirects users to the secure version of the site.
Enable express' "trust proxy" setting

This means that express will set 'req.protocol' as 'https' based on the
value of the 'X-Forwarded-Proto' header.

See http://expressjs.com/3x/api.html#app-settings
Enable secure cookies
Allow base_url to take an optional path arg

This makes it easier to construct a url without having to do string
concatenation.
Use current url for API rather than hardcoding http

This exposes the base_url function to the templates to make it easier to
generate a url based on the current protocol/hostname.
Don't rely on the hosting_site_base_url being http
Show the correct protocol on create instance form
Use instance.base_url on new instance creation error

Exposes the instance.base_url to the template for use in error messages
when the instance creation has failed.
Always use https://popit.mysociety.org address
Use https urls in package.json where relevant