Selectively enable GZIP when HTTP referer matches external URL of GitLab host

gzip is disabled for HTTPS for a number of reasons, but Rails has anti-BREACH measures in place for CSRF tokens. In addition, we can mitigate the risk of this attack further by enabling GZIP only when the HTTP referer matches the GitLab origin.

For more details, see:

• https://blog.qualys.com/ssllabs/2013/08/07/defending-against-the-breach-attack
• https://gitlab.com/gitlab-org/gitlab-ce/issues/33719

spec/chef/recipes/nginx_spec.rb

@@ -257,7 +257,8 @@ describe 'nginx' do
     it 'applies HTTP referer checks to gitlab-http' do
       chef_run.converge('gitlab::default')
       expect(chef_run).to render_file(http_conf['gitlab']).with_content { |content|
-        expect(content).to include("if ($http_referer ~* (^https://localhost(/.*)?$)") }
+        expect(content).to include("if ($http_referer ~* (^https://localhost(/.*)?$)")
+      }
     end
 
     it 'applies mattermost_nginx verify client settings to gitlab-mattermost-http' do