Add the two ways to set headers in secure-ssl.conf

In some servers, Apache secure-ssl.conf is setting headers in the 'always'
table and unsetting them in the 'onsuccess' table; on other servers it's
the opposite. I don't know the reason behind the two ways of setting
headers on those specific servers, but that's research for another day.

Modify the secure-ssl.conf template to implement this difference, add
hostvars to the servers using onsuccess, and add those hosts to the apache
group.

leptone, milonia and nicoda are still commented out because there are
differences on other config files that I didn't deal with yet.