fix: gate ssl_reject_handshake behind nginx 1.19.4

The shipped catch-all default site uses `ssl_reject_handshake`, which is unsupported on nginx older than 1.19.4 and causes nginx to fail to start on Debian Bullseye. The postinst now detects the installed nginx version and installs an HTTP-only variant of the catch-all on older systems.

plugins/nginx-vhosts/templates/default-site-legacy.conf

@@ -0,0 +1,13 @@
+# Catch-all server block for requests with unknown Host headers.
+# Installed on fresh apt installs of dokku when nginx < 1.19.4
+# (which lacks ssl_reject_handshake support); safe to edit.
+# See /etc/nginx/conf.d/dokku.conf for the per-app server blocks.
+server {
+    listen      80 default_server;
+    listen      [::]:80 default_server;
+
+    server_name _;
+    access_log  off;
+
+    return 444;
+}