nixos/nginx: Allow unsetting ssl_ciphers

[aneeshusa]

Motivation for this change

When using the Modern config from the Mozilla SSL config generator,
the ssl_ciphers parameter does not need to be set
as only TLSv1.3 is permitted and all of its ciphers are reasonable.

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

[aneeshusa]

Current output of https://ssl-config.mozilla.org/#server=nginx&version=1.19.3&config=modern&openssl=1.1.1g&guideline=5.6 (nginx & openssl versions from nixos-unstable):

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    ssl_certificate /path/to/signed_cert_plus_intermediates;
    ssl_certificate_key /path/to/private_key;
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
    ssl_session_tickets off;

    # modern configuration
    ssl_protocols TLSv1.3;
    ssl_prefer_server_ciphers off;

    # HSTS (ngx_http_headers_module is required) (63072000 seconds)
    add_header Strict-Transport-Security "max-age=63072000" always;

    # OCSP stapling
    ssl_stapling on;
    ssl_stapling_verify on;

    # verify chain of trust of OCSP response using Root CA and Intermediate certs
    ssl_trusted_certificate /path/to/root_CA_cert_plus_intermediates;

    # replace with the IP address of your resolver
    resolver 127.0.0.1;
}

Note the lack of ssl_ciphers.

mozilla/ssl-config-generator#53 is an issue on the Mozilla repo with more info about why this isn't needed.

cc @emilazy @Mic92 who edited our default ciphers in #81891 and