icebox configuration: lock down the /artifacts/import method

When the oq-engine-server finishes a calculation, it can optionally POST to icebox's /artifacts/import endpoint and pass in a oq-engine-server URL from which icebox can import calculation results. (See https://docs.google.com/a/openquake.org/drawings/d/1oCXtOrrkk4YDi-vF2xLOjh6s7ZZKtoiKAM9-nX4QTB0) However, since this method doesn't require authentication, there is potential for DoS exploitation by posting bogus requests. Thus, when the icebox is installed, we need to configure the webserver to restrict access and only allows POSTs from the oq-engine-server.