Fix IANA recommended plus hybrid NCSC-NL-TLS-2025-05 compliant curves

[bwbroersma]

sed -ri "s/^(ssl_ecdh_curve\s+)[a-zA-Z0-9:]+/\1$(curl -sSf "https://www.iana.org/assignments/tls-parameters/tls-parameters-8.csv"|awk -F, '$4=="Y"||$4=="N"&&$5~/ecdhe-mlkem/{print$2}'|tac|tr '\n' :|head -c-1)/" docker/webserver/nginx_templates/tls.conf.template

This removes the non recommended IANA curves:

• secp521r1
• brainpoolP512r1
• brainpoolP384r1
• brainpoolP256r1

Note that the NCSC-NL also notes about the brainpool* curves (translated from Dutch):

In practice, brainpool* curves are used significantly less than other curves. Investigate whether the use of these curves is truly necessary for your application, or whether you can use other curves.

@baknu already correctly noticed in the NCSC-NL-TLS-2025-05 content, I did not notice this text when I converted the Table 3 to a nginx TLS configuration.

Note I also dropped secp521r1 since it's not recommended by IANA.
Note this moves x25519 in front of secp384r1, because it uses the reversed IANA order (with tac), while previously it was ordered on the cryptographic strength listed in Table 3 (with preference for x448 and x25519 over similar strength secp*).