scripts: only bootstrap website if we ask it to

cc/ @sethvargo We won't always have the BINTRAY_API_KEY in the env,
and that was causing the variable to get nuked so I made
an explicit BOOTSTRAP=1 flag here.
script: make sure we're force pushing the website

cc/ @sethvargo I had to roll this back because it was rejecting it,
asking me to fetch first. `subtree push --prefix website heroku master`
doesn't have a --force equivalent that I could find, and we need
to do that every time.
website: require ssl enforceer