update lighttpd to new upstream release (v1.4.9), add -mod-evasive subpackage.