feat: enable OCSP stapling

OCSP stapling improves TLS handshake performance and privacy by
having the server provide certificate revocation status directly,
so clients don't need to query the CA separately.

conf.d/10-defaults.conf.template

@@ -4,6 +4,11 @@ ssl_session_cache shared:SSL:10m;
 ssl_session_timeout 10m;
 ssl_session_tickets off;
 
+ssl_stapling on;
+ssl_stapling_verify on;
+resolver 1.1.1.1 8.8.8.8 valid=300s;
+resolver_timeout 5s;
+
 server {
     listen 80 default_server;
     listen [::]:80 default_server;