mailserver: fix possible reload deadlock when SSL certificate and mail server
configuration change at the same time. We have seen cases where postfix was
down because of that problem (#PL-130204).
mailserver: use relaxed/relaxed DKIM canonicalization algorithms to avoid
invalid signatures when mail providers change whitespace in messages, for example.
Be explicit about which unfree packages are allowed on our platform by default
instead of generally allowing them. MongoDB under the SSPL license is allowed by
default. Unfree Elastic packages (elasticsearch6/7, kibana6/7) can no longer be
used on machines without explicitly allowing these packages there. There's a new
option flyingcircus.allowUnfreePackageNames to do that (#PL-130528).