Motivation for this change

The recommended TLS configuration comes with ssl_stapling on and
ssl_stapling_verify on. However, this last directive also requires
the use of ssl_trusted_certificate to verify the received answer.
When using enableACME or similar, we can help the user by providing
the correct value for the directive.

The result can be tested with:

openssl s_client -connect web.example.com:443 -status 2> /dev/null

Without OCSP stapling, we get:

OCSP response: no response sent

After this change, we get:

OCSP Response Data:
    OCSP Response Status: successful (0x0)
    Response Type: Basic OCSP Response
    Version: 1 (0x0)
    Responder Id: C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
    Produced At: Aug 30 20:46:00 2018 GMT

Things done

• Tested in a NixOS VM (should I use sandboxing?)
• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Fits CONTRIBUTING.md.