Openresty proxy handles TLS for apps on app.internal domain

[mogul]

User Story

In order to prevent lateral traversal between compromised apps, the data.gov ISSM wants traffic for cloud.gov apps running on the app.internal domain to be secured with TLS.

Acceptance Criteria

[ACs should be clearly demoable/verifiable whenever possible. Try specifying them using BDD.]

• GIVEN [a contextual precondition]
  [AND optionally another precondition]
  WHEN [a triggering event] happens
  THEN [a verifiable outcome]
  [AND optionally another verifiable outcome]

Background

See #2945

Security Considerations (required)

This change increases the security around traffic intended for cloud.gov apps on the app.internal domain.

Sketch

[Notes or a checklist reflecting our understanding of the selected approach]

Originally posted by @mogul in #2945 (comment)

I've identified one approach I'm comfortable with for doing this: Deploy an nginx-buildpack proxy app which uses OpenResty to auto-rotate the TLS certificate on the app.internal domain. Then deploy the actual app as a sidecar to the proxy app.