Reverse proxy return 404 for /_raindrops
Reverse proxy return 404 for /_raindrops

Return 404 for requests to `/_raindrops` instead of returning 403 for
requests that don't originate from loopback.

This was originally implemented in b1685d5 to prevent raindrops stats from
ever being exposed beyond the local machine. It shouldn't possible to see
these either internally between machines, and externally for applications
that have public-facing routes for `/`.

As it happens we made it laxer than it needed to be. collectd goes directly
to Unicorn's bound port on loopback and never through Nginx. The only other
use of the Nginx reverse-proxy for this path would be for humans wanting to
view it directly instead of through Graphite. However there's actually very
little benefit in that - if you need to log into the machine, you can
probably lookup the application's port.

As a result we can remove the `proxy_pass` and `allow 127.0.0.1` altogether.

In doing so I've also replaced `deny all` with `return 404`. This masks the
fact that we're trying to hide something interesting. For vhosts that have
`intercept_errors` this will be replaced by a stylised page, as usual.

This should also fix the following unexpected behaviour (which I think comes
from the frontend vhost), by emitting a stylised 404 page instead:

```
➜  puppet git:(never_proxy_raindrops_endpoint) ✗ curl -i --compressed https://www.gov.uk/_raindrops
HTTP/1.1 403 Forbidden
Server: nginx
Content-Type: text/html
Content-Length: 124
Vary: Accept-Encoding
Content-Encoding: gzip
X-Varnish-Defaulted: 1
Accept-Ranges: bytes
X-Varnish: 612757455
Cache-Control: max-age=864
Date: Thu, 11 Jul 2013 15:44:26 GMT
Connection: keep-alive

<html>
<head><title>403 Forbidden</title></head>
<body bgcolor="white">
<center><h1>403 Forbidden</h1></center>
<hr><center>nginx</center>
</body>
</html>
```

alphagov/govuk-puppet,alphagov/govuk-puppet,alphagov/govuk-puppet,alphagov/govuk-puppet,alphagov/govuk-puppet,alphagov/govuk-puppet