fix: set HiddenServicePoWDefensesEnabled only on explicit securedrop_…

…app_pow_on_source_interface=True

Otherwise a "securedrop-admin install" without a prior "securedrop-admin
sdconfig" will default to enabling this feature.  Let's not surprise an
administrator who likely intended to enforce the existing configuration.

Co-authored-by: Kevin O'Gorman <kog@freedom.press>
(cherry picked from commit 02a81f1)

install_files/ansible-base/roles/tor-hidden-services/templates/torrc

@@ -6,7 +6,7 @@ RunAsDaemon 1
 HiddenServiceDir /var/lib/tor/services/sourcev3
 HiddenServicePort 80 127.0.0.1:80
 
-{% if securedrop_app_pow_on_source_interface|default(True) %}
+{% if securedrop_app_pow_on_source_interface|default(False) %}
 HiddenServicePoWDefensesEnabled 1
 {% endif %}