debops pki cannot remove domain from acme_domains

when deploying the role pki to a server with the following variables defined

---
# Special PKI realm for host
pki_acme_contacts: 
  - 'mailto:letsencrypt@mail.tld'
    # Can also include different domains like 'mail.example.org'
    # in the same realm.
pki_realms:
  - name: '{{ ansible_fqdn }}'
    acme: True
    acme_default_subdomains: []
    acme_ca: 'le-live-v2' #for production
    # acme_ca: 'le-staging-v2'
    acme_domains: [ 'cloud.server.tld', 'nextcloud.server.tld', 'git.server.tld' ]

and removing one of the acme_domains debops cannot remove the acme_domain from the pki realm on the server. This will cause the acme request to change, if for example a service got migrated to another server.

A workaround is to delete the realm entirely on the remote server and provision the pki role again.

Start with the DebOps pki role and the pki_realms.acme_domains handling. Reproduce a deployment where one listed domain is removed, then inspect the resulting remote PKI realm and ACME request. Done means the removed domain is no longer present without deleting and reprovisioning the entire realm.