Signed-off-by: Tw <tw19881113@gmail.com>

This adds the ask sub-directive to tls that defines the URL of a backend HTTP service to be queried during the TLS handshake to determine if an on-demand TLS certificate should be acquired for incoming hostnames. When the ask sub-directive is defined, Caddy will query the URL for permission to acquire a cert by making a HTTP GET request to the URL including the requested domain in the query string. If the backend service returns a 2xx response Caddy will acquire a cert. Any other response code (including 3xx redirects) are be considered a rejection and the certificate will not be acquired.

* Update build instruction

This changes add proper an easy instruction for building.

* Update README.md

The rc.subr framework already takes care of substituting user. So, using
daemon's -u option is double user-substitution and fails if $caddy_user
is non-root.

caddy.go:569: could be simplified

sigtrap_posix.go:87: value of inst is never used

upgrade.go:151: should omit nil check; len() for nil slices is defined as zero

Changes the log output of on startup

* Handle the case of an OCSP responder certificate expiring before an OCSP response it issued

* oops

* doh, gofmt

A default of true is risky when protecting assets by matching base path.
It's not obvious that protecting /foo/ will allow /Foo/ through, and if
accessing static files on a case-insensitive file system... that's no
good. So the default is now to be case-INsensitive when matching paths.

Provides a new hook for plugins as a means to provide the current caddy.Instance when starting or restarting.

* Implement 'command' plugin

* Rename 'command' to 'on'

* Split this PR

This allows you to have multiple redir directives conditioned solely
upon if statements, without regard to path.

I am not a lawyer, but according to the appendix of the license,
these boilerplate notices should be included with every source file.