loki/nginx: Add recording rule for tracking HTTP/TLS version and cipher

Mainly because we are curious. The data may also be used to decide if we
want to drop older versions of TLS.

roles/loki/files/rules.yaml

-groups: []
+groups:
+  - name: NginxRules
+    interval: 1m
+    rules:
+      - record: nginx:requests:rate1m
+        expr: 'sum by (instance, server_protocol, ssl_protocol, ssl_cipher) (rate({job="nginx"}[1m] | json))'

roles/nginx/templates/nginx.conf.j2

@@ -28,12 +28,13 @@ http {
         '$remote_addr $host $remote_user [$time_local] "$request" '
         '$status $body_bytes_sent "$http_referer" '
         '"$http_user_agent" "$http_x_forwarded_for" $request_time '
-        '$server_protocol';
+        '$server_protocol $ssl_protocol $ssl_cipher';
 
     log_format reduced
         '$host [$time_local] "$request" '
         '$status $body_bytes_sent "$http_referer" '
-        '"$http_user_agent" $server_protocol';
+        '"$http_user_agent" $server_protocol $ssl_protocol '
+        '$ssl_cipher';
 
     log_format json_main escape=json
         '{'
@@ -50,6 +51,8 @@ http {
         '"http_x_forwarded_for":"$http_x_forwarded_for",'
         '"request_time":"$request_time",'
         '"server_protocol":"$server_protocol",'
+        '"ssl_protocol":"$ssl_protocol",'
+        '"ssl_cipher":"$ssl_cipher",'
         # This was added to keep every log line unique as Loki drops
         # log line with the same timestamp and log text:
         # https://grafana.com/docs/loki/latest/overview/#timestamp-ordering
@@ -68,6 +71,8 @@ http {
         '"http_referrer":"$http_referer",'
         '"http_user_agent":"$http_user_agent",'
         '"server_protocol":"$server_protocol",'
+        '"ssl_protocol":"$ssl_protocol",'
+        '"ssl_cipher":"$ssl_cipher",'
         # This was added to keep every log line unique as Loki drops
         # log line with the same timestamp and log text:
         # https://grafana.com/docs/loki/latest/overview/#timestamp-ordering