[hoftix] move splash and staging to new server

update inventories

• update inventory.tmpl files with new IP addresses! (including new staging server!)

add tooling for staging server:

• add .env.staging (blackbox-encrypted)
• add make commands to provision/deploy/harden staging server
• revise deploy.yml to make it possible to copy vhost.d files using copy method of secret deployment (so we don't need to put pgp key on staging box to decrypt vhost.d files)

spruce up all ansible tooling

• add python3 dependencies in all playbooks
• specify python3 interpreter in all inventories
• prevent provision from trying to install docker-compose in the docker role
• run docker roles in consistent way in splash and prod/staging (always after apt package installs)
• add make commands to provision and harden splash

docs:

• add GOTCHA about docker DNS configs to README