chore(haproxy,terraform): harden haproxy stats and pin incus provider

- Add maxconn limit and HTTP timeouts to mitigate slowloris attacks
- Restrict stats endpoint to internal LAN and localhost only
- Hide HAProxy version on stats page
- Pin Incus Terraform provider to ~> 1.0 for stability

terraform/versions.tf

@@ -4,6 +4,7 @@ terraform {
   required_providers {
     incus = {
       source  = "lxc/incus"
+      version = "~> 1.0"
     }
   }
 }