This helps people who run federation on another domain (etc.).
They should now easily be able to add a custom rule for federation traffic.

Fixes a regression introduced in 0220c851e8

BuildX is required for building this container image.

This makes it consistent with the rest of the playbook:
- there's a default config which has various variables controlling
  settings
- there's also an `_extension_yaml` variable, which lets you override it

We disable it via `group_vars/matrix_servers`, as we do for all other
roles.

The next task asks for a daemon reload, so there's no need to do it
twice.

Larger deployments may wish to run migration more often.

`always` is an nginx suffix, which shouldn't have been added to these.

The newly extracted role also has native Traefik support,
so we no longer need to rely on `matrix-nginx-proxy` for
reverse-proxying to Ntfy.

The new role uses port `80` inside the container (not `8080`, like
before), because that's the default assumption of the officially
published container image. Using a custom port (like `8080`), means the
default healthcheck command (which hardcodes port `80`) doesn't work.
Instead of fiddling to override the healthcheck command, we've decided
to stick to the default port instead. This only affects the
inside-the-container port, not any external ports.

The new role also supports adding the network ranges of the container's
multiple additional networks as "exempt hosts". Previously, only one
network's address range was added to "exempt hosts".

Wiring happens via `group_vars/matrix_servers` now.