Update riot-web (1.3.0 -> 1.3.2)

# Auth server config
        auth:
            # Publicly accessible base URL for the login endpoints.
            # The prefix below is not implicitly added. This URL and all subpaths should be proxied
            # or otherwise pointed to the appservice's webserver to the path specified below (prefix).
            # This path should usually include a trailing slash.
            public: http://example.com/login/
            # Internal prefix in the appservice web server for the login endpoints.
            prefix: /login

It's been pointed out that DEBUG logs could contain sensitive
information (access tokens, etc.), which makes them unsuitable
for sharing with others. INFO should be enough.

Clarify sentence about dedicated user for access token

Also discussed previously in #213 (Github Pull Request).

shared-secret-auth and rest-auth logging is still at `INFO`
intentionally, as user login events seem more important to keep.
Those modules typically don't spam as much.

We recently had someone in the support room who set it to `false`
and the playbook ran without any issues.

This currently seems to yield the same result as 'none', but it's
better to avoid such behavior.

Refer to 524436ebef and #230 (Github Issue).

Fixes #230 (Github Issue).

Related to https://github.com/Half-Shot/matrix-appservice-discord/issues/510

It adds support for a new `DISABLE_SENDER_VERIFICATION` environment
variable that can be used to disable verification of sender addresses.

It doesn't matter for us, but we upgrade to keep up with latest.

Fix apt message: docker doesn't support arch 'i386'

Related to #223 (Github Pull Request)

Update synapse (1.1.0 -> 1.2.0)

Update nginx (1.17.1 -> 1.17.2)