www: redirect alias hostnames (e.g. apex) to canonical origin

Adds www_redirect_hostnames; renders a www-redirect ingress that 301s
to https://<www_hostname>$request_uri while leaving more specific paths
on the same host (e.g. /.well-known/matrix/*) to their own ingresses.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/render.yml

@@ -11,6 +11,7 @@
     - name: Supply nonsecret fixture settings
       ansible.builtin.set_fact:
         www_membership_image: registry.example.org/www-membership:release-test
+        www_redirect_hostnames: [apex.example.com]
         www_membership_service_groups:
           "0": ["cn=free-service,ou=groups,dc=example,dc=org"]
           "2": ["cn=paid-service,ou=groups,dc=example,dc=org", "cn=second-service,ou=groups,dc=example,dc=org"]