propose explicit showing single quotes around the password, since I forgot to put them there.

I got at least a few reports of people pasting these statements one by
one and missing the `;`.

In short, this makes Synapse a 2nd class citizen,
preparing for a future where it's just one-of-many homeserver software
options.

We also no longer have a default Postgres superuser password,
which improves security.

The changelog explains more as to why this was done
and how to proceed from here.

I had intentionally held it back in 39ea3496a4
until:
- it received more testing (there were a few bugs during the
migration, but now it seems OK)
- this migration guide was written

Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/756

Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/737

I feel like timers are somewhat more complicated and dirty (compared to
cronjobs), but they come with these benefits:

- log output goes to journald
- on newer systemd distros, you can see when the timer fired, when it
will fire, etc.
- we don't need to rely on cron (reducing our dependencies to just
systemd + Docker)

Cronjobs work well, but it's one more dependency that needs to be
installed. We were even asking people to install it manually
(in `docs/prerequisites.md`), which could have gone unnoticed.

Once in a while someone says "my SSL certificates didn't renew"
and it's likely because they forgot to install a cron daemon.

Switching to systemd timers means that installation is simpler
and more unified.

The different configurations are now all lower case, for consistent
naming.

`matrix_nginx_proxy_ssl_config` is now called
`matrix_nginx_proxy_ssl_preset`. The different options for "modern",
"intermediate" and "old" are stored in the main.yml file, instead of
being hardcoded in the configuration files. This will improve the
maintainability of the code.

The "custom" preset was removed. Now if one of the variables is set, it
will use it instead of the preset. This will allow to mix and match more
easily, for example using all the intermediate options but only
supporting TLSv1.2. This will also provide better backward
compatibility.

Related to
- https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/740
- https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/686

The breaking changes are properly documented in the CHANGELOG.md file.
The date used is specified as XXXX-XX-XX and should be modified at the
moment of merge.

Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/746

ma1sd requires the openid endpoints for certain functionality.
Example: 90b2b5301c/src/main/java/io/kamax/mxisd/auth/AccountManager.java (L67-L99)

If federation is disabled, we still need to expose these openid APIs on the
federation port.

Previously, we were doing similar magic for Dimension.
As per its documentation, when running unfederated, one is to enable
the openid listener as well. As per their recommendation, people
are advised to do enable it on the Client-Server API port
and use the `federationUrl` variable to override where the federation
port is (making federation requests go to the Client-Server API).

Because ma1sd always uses the federation port (unless you do some
DNS overwriting magic using its configuration -- which we'd rather not
do), it's better if we just default to putting the `openid` listener
where it belongs - on the federation port.

With this commit, we retain the "automatically enable openid APIs" thing
we've been doing for Dimension, but move it to the federation port instead.
We also now do the same thing when ma1sd is enabled.

A bit late, but still better than nothing.

Related to #681 (Github Pull Request)

Fixes #696 (Github Issue)

Fixes #685 (Github Issue).

Related to 23daec748c and #662 (Github Issue).

Fixes #562 (Github Issue)

Fixes #586 (Github Issue)

Related to #557 (Github Pull Request).

Related to #540 (Github Pull Request).

Related to #551 and #555 (Github Pull Requests).

We can undo this once https://github.com/ma1uta/ma1sd/issues/44 gets
resolved.

Note the potential breaking change

Resolves #474

Related to #454 (Github Pull Request).