varnish: Refuse access to unknown vhost

This defined a vhost which explicitely refuses access when an unknown vhost is detected.

This will allow to fix the current caveat, access to "hedgedoc" (default vhost) from
http(s)://swh-rproxy3.inria.fr or from the associated ip.

The other vhosts are still responding appropriately.

Related to T2962