graceful stop of nghttp2::asio_http2::server::http2

nghttpx: add systemd support

Explicit io_service::stop() will prevent running streams from
finishing their task. That means if there are already reposnes
that we have called end(std::string) on them and they have not
finished sending back their data, they will be closed with a
NGHTTP2_INTERNAL_ERROR
Instead, we can stop accepting connections and destroy all
io_service::work objects to signals end of work.

  Add systemd's Type=notify support by sending information about
 master process PID around forks.
  Add some hardening option to service unit.

nghttpx supports multiple certificates using --subcert option.
Previously, SNI hostname is used to select certificate.  With this
commit, signature algorithm presented by client is also taken into
consideration.  nghttpx now accepts certificates which share the same
hostname (CN, SAN), but have different signature algorithm (e.g.,
ECDSA+SHA256, RSA+SHA256).

Currently, this feature requires OpenSSL >= 1.0.2.  BoringSSL, and
LibreSSL do not work since they lack required APIs.

close_stream erases from streams_ while it's being iterated over.

The destructor will already clean this structure up.

nghttpx: Add frontend-tls parameter to backend to require client TLS