WIP: apache2: setup apt proxy, only available to known hosts

This should be sufficient to allow access to the embargoed security archive from the CI workers, using the central server as a proxy, with only the central CI server needing to be allowed access.

cookbooks/debci/config/ci-master.debian.net.yml.asc at the moment is the same as cookbooks/debci/config/debci-master.local.yml, just encrypted in preparation for adding the actual embargoed security archive.