nixos/piwik: fix nginx submodule's ssl defaults

previous mkDefault did not work as expected,
as it did not overwrite the original submodule's defaults when the user
did not specify any custom options at all.