Add a (single) onion service for the new tor blog

When we asked for this for the old blog, it wasn't technically feasible (or it was a legacy system, so we decided not to do it).

I hope that onion service compatibility (mainly URL rewrites) was one of the requirements for the new blog.