Update template and fix ServiceDescription 2xit,0xde
See also https://github.com/clarin-eric/SPF-SPs-metadata/pull/224

```
docker pull
gitlab.inf.unibz.it:4567/commul/docker/clarin-dspace/production/nginx:1.3.5
docker run
gitlab.inf.unibz.it:4567/commul/docker/clarin-dspace/production/nginx:1.3.5
docker cp clarin.eurac.edu.template.metadata.xml 738bada50a9a:/tmp
docker exec -ti 738bada50a9a /bin/bash
container
docker commit 738bada50a9a
gitlab.inf.unibz.it:4567/commul/docker/clarin-dspace/production/nginx:1.3.5-hf1.1
docker push
gitlab.inf.unibz.it:4567/commul/docker/clarin-dspace/production/nginx:1.3.5-hf1.1
```

Then run `kubectl --namespace=dspace edit deployment.apps/nginx` and
adapt `image`.

In certain situations, for example, when checking the "Other versions"
dropdown menu a request (possibly after a redirect) is made to
`port:8443`. Of course, this results in an error (because the
clarin-dspace is behind a reverse proxy).
```
OPTIONS https://clarin.eurac.edu:8443/repository/rest/handle/20.500.12124/6/refbox net::ERR_CONNECTION_TIMED_OUT
```

Here, we make sure tomcat will only redirect to `port:443` which is the
port the reverse proxy serves.

So far, we have used TLS certs from eurac's IT. Now, we (re-)use k8s
infrastructure (in particular the kube-lego add-on) and let kube-lego
- request/renew TLS certificates
- manage the certificate within a k8s secret
We then make this k8s secret available to our nginx and configure nginx
to use it.

We also got rid of internal TLS communication between ingress and the
apps avoiding the necessity to (re-)create valid/self-signed certs. The
overhead seemed unnecessary.

Note: using HTTP(!) over port 443 for internal communication (Shibboleth mishap)

Fix #62

Found two lines in robots.txt at UFAL's installation that seem ok. Add
also to our stash:
```
Disallow: /repository/*allzip$
Disallow: /repository/oai/requeststripped
```

We use `timeout` from the coreutils package (should be part of many basic
installations - maybe with a different name) to force the individual
healthcheck commands too exit after a predefined timeout (300s); if this
doesn't help, send a SIGKILL.

This should help with the initial problem of hanging. A next step should
be to catch the `timeout` invoked exit and log this as an exceptional
happening.

Address #60

Instead of an external CronJob pod, or a supervisord cron daemon, we use
a subshell. Also we assume, the regular cronjob *also* needs to run when
the container starts. Insofar, we start the subshell, make sure it runs
a single time (and continues in the background) and then continue with
starting clarin-dspace.

Address #48

Sync config with https://gitlab.inf.unibz.it/commul/docker/commons/blob/master/helm-charts/webserver/nginx.conf

Prefix (oai/requeststripped) and add entries in robots.txt.

- sitemaps are now generated in the entrypoint script