Add full ONLYOFFICE integration:

- New web-svc-onlyoffice role (Docker, env, CSP, proxy hooks)
- Nextcloud plugin integration with JWT and CSP updates
- Custom Nextcloud image with updated CA certificates
- Networking and port assignments
- Disabled Collabora by default
- Enabled ONLYOFFICE by default
- Link to conversation for reference: https://chatgpt.com/share/691f49ac-54d8-800f-83c3-60cf8c100183

roles/web-svc-onlyoffice/config/main.yml

@@ -0,0 +1,32 @@
+server:
+  domains:
+    canonical:
+      - "onlyoffice.{{ PRIMARY_DOMAIN }}"
+    aliases: []
+  csp:
+    whitelist:
+      frame-ancestors:
+        - "{{ WEB_PROTOCOL }}://*.{{ PRIMARY_DOMAIN }}"
+    flags:
+      script-src-attr:
+        unsafe-inline:  true
+      script-src-elem:
+        unsafe-inline:  true
+        unsafe-eval:    true
+docker:
+  services:
+    redis:
+      enabled: false
+    database:
+      enabled: false
+    onlyoffice:
+      image:            "onlyoffice/documentserver"
+      version:          "latest"
+      name:             "onlyoffice"
+      cpus:             2
+      mem_reservation:  "1g"
+      mem_limit:        "2g"
+      pids_limit:       2048
+features:
+  logout:  false
+  desktop: true