Magento NGINX Hardening (APSB26-73)

## Description

This patch applies the NGINX part of Adobe's [APSB26-73](https://helpx.adobe.com/security/products/magento/apsb26-73.html) fix and hardens the surrounding NGINX configuration for Magento sites. It adds the `/media/customer_address/` deny rule called for by APSB26-73, and hoists that along with a set of other important deny rules to the top of each site's included configuration. Because NGINX evaluates them first, no configuration included afterward can override or weaken them.

## Impact

There is no persistent downtime expected. The NGINX configuration is validated with `nginx -t` before NGINX is restarted on the web nodes, which briefly resets connections on each node as it restarts.

## Changes

- Drops a hardening config (`00-magento-nginx-hardening.conf`) at the top of each Magento site's include order, so its deny rules are evaluated first and cannot be overridden by any configuration included after it. These deny rules include the `/media/customer_address/` path that is part of APSB26-73.
- Validates the NGINX configuration and restarts NGINX on the web nodes.

## If You Accept

The APSB26-73 exposure is closed, and the important deny rules are enforced ahead of the rest of the site configuration and cannot be relaxed by anything loaded afterward.

## If You Reject

The APSB26-73 `/media/customer_address/` exposure remains, and the other deny rules are not hoisted to the top.