Allow HTTP_X_FORWARDED_FOR at server level instead of declaring it per-application

The stage 5 smoke test failure was a locked config section, but not one of the
two the installer unlocks. A diagnostic collected from the server returned:

  HTTP 500.52 - URL Rewrite Module Error
  Module RewriteModule, Handler httpplatformhandler
  Error Code 0x80070021
  Config Error: This configuration section cannot be used at this path.
  Config File: \\?\C:\shopdb-flask\web.config

handlers and httpPlatform were both overrideMode Allow and locked false, so
the unlock had worked. The section at fault was a third one,
system.webServer/rewrite/allowedServerVariables, which ships
overrideModeDefault="Deny". web.config declared <allowedServerVariables>
locally for the X-Forwarded-For rule, and IIS rejects that declaration
outright, failing the entire configuration before httpPlatformHandler ran.
python was therefore never launched and C:\shopdb-flask\logs stayed empty,
which reads as a dead application or a permissions fault and is neither.

Unlocking the section would let every site on the machine declare arbitrary
server variables. The installer now adds the single variable to the
server-level allow list, checking first because a duplicate add is an error,
and web.config no longer declares it. The rewrite rule is unchanged.

Verified by applying the installer's own uncommenting to the template and
parsing the result: one rewrite element, no allowedServerVariables, the rule
still setting HTTP_X_FORWARDED_FOR from REMOTE_ADDR.

shopdb-diagnose.py checked only the two sections the installer unlocks, so it
could not have named this one; the IIS error page did. It now reports the
lock state of the rewrite sections as well.

deploy/windows/shopdb-diagnose.py

@@ -257,7 +257,16 @@ def main():
         report.block('modules: httpPlatformHandler present?',
                      run([appcmd, 'list', 'modules']))
         # overrideMode tells us whether the unlock actually took effect.
-        for section in ('system.webServer/handlers', 'system.webServer/httpPlatform'):
+        #
+        # allowedServerVariables is in this list because it caused a 500.52 that
+        # the first two sections could not explain: it is Deny by default, so an
+        # <allowedServerVariables> block in the app's web.config is rejected
+        # before httpPlatformHandler runs. Checking only the sections we unlock
+        # would have missed the one we do not.
+        for section in ('system.webServer/handlers',
+                        'system.webServer/httpPlatform',
+                        'system.webServer/rewrite/allowedServerVariables',
+                        'system.webServer/rewrite/rules'):
             report.block('lock state of %s' % section,
                          run([appcmd, 'list', 'config', '/section:%s' % section,
                               '/text:*']))