Fixes #685 (Github Issue).

The SSL certificates should be accessible to the nginx proxy container, not the synapse container.

also, worker.yaml.j2:
  - hone worker_name
  - remove worker_pid_file entry (would only be used if worker_daemonize
    set to true; also, synapse only knows about the container namespace
    and thus can not provide the required host-view PID)

add variables for secure_backup_required and secure_backup_setup_methods

Discussed in #669 (Github Issue).

Upgrade Element (1.7.8 -> 1.7.9)

Update nginx (1.19.2 -> 1.19.3)

Shameless refactor of all systemd descriptions for bridges

Upgrade Synapse (v1.20.1 -> v1.21.0)

Add docker prune

& restrict federation listener; frontend_proxy / user_dir don't need it

.. alphabetically and put those not documented as multi-instance
capable on ports ending on zero.

Is the PID magic gonna work? or will it need an ExecStartPost hack..

- cherry-pick "Ensure worker config exists in systemd service (#7528)"
  from synapse d74cdc1a42e8b487d74c214b1d0ca575429d546a:
  "check that the worker config file exists instead of silently failing."