Fixes a regression introduced in 0220c851e8

BuildX is required for building this container image.

This makes it consistent with the rest of the playbook:
- there's a default config which has various variables controlling
  settings
- there's also an `_extension_yaml` variable, which lets you override it

We disable it via `group_vars/matrix_servers`, as we do for all other
roles.

The next task asks for a daemon reload, so there's no need to do it
twice.

Larger deployments may wish to run migration more often.

`always` is an nginx suffix, which shouldn't have been added to these.

The newly extracted role also has native Traefik support,
so we no longer need to rely on `matrix-nginx-proxy` for
reverse-proxying to Ntfy.

The new role uses port `80` inside the container (not `8080`, like
before), because that's the default assumption of the officially
published container image. Using a custom port (like `8080`), means the
default healthcheck command (which hardcodes port `80`) doesn't work.
Instead of fiddling to override the healthcheck command, we've decided
to stick to the default port instead. This only affects the
inside-the-container port, not any external ports.

The new role also supports adding the network ranges of the container's
multiple additional networks as "exempt hosts". Previously, only one
network's address range was added to "exempt hosts".

Wiring happens via `group_vars/matrix_servers` now.

.. and try to auto-switch between `bind` and `volume` depending on
whether there's a slash in the `src` path.

Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/2482

Related to 6a52be7987 and 28e7ef9c71f02

* make banlist consistent
* proper multi-error message
* ignore "." MX hosts
* try recipient domain directly, even when MX records found, but failed

Signed-off-by: Julian-Samuel Gebühr <julian-samuel@gebuehr.net>

Previously, it had to go through matrix-nginx-proxy.
It's exposed to Traefik directly via container labels now