refactor(nginx): Split ingress into internet and intranet

This patch refactors the entire ingress setup into two ingress classes:
internet and intranet. This allows to ensure that they use separate
services, reduces the attack surface and enables the usage of
external-dns.