We have a bunch of sites that are not fronted by the CDN. This also means they generally only live in eqiad and/or codfw, which also means that users in EMEA/Asia/etc take a totally different path to these sites than they do to the CDN.

We've had a few issues recently where SREs and other technical contributors have been unable to reach sites like gerrit, lists.wm.o, integration.wm.o, icinga.wm.o, etc.

Let's make these sites also serve the same NEL headers as production.

Probably the best way to do this is to define some top-level hiera with a map of names and values for headers (we need to serve both NEL: and Report-To:) and then modify other Puppet code to reference this hiera as needed (whether Apache or Nginx config snippets).

We can also make the current gross mess that is in wikimedia-frontend.vcl.erb be generated from this hiera as well.