ACME renewals

The ACME certificates are still acquired through Terraform and then copied to all instances that require them (that's only monitoring now).
There is no code in place anymore to actually renew them, and I'd rather not have them in the terraform state. The current approach was chosen to avoid issuing 4 different certificates and hitting rate limits for the three cores and monitoring.

- [ ] The ingress module needs to know about the location of the ACME certificate. Right now they're placed in `/etc/ssl/certs` and then copied on unit start.
- [ ] The code for the ACME module doing the issuing and renewal using route53 was removed in 3dcc52fd1e98caed639fc9f46b463045c5d47f77 and should help in restoring the original functionality.
- [ ] Ideally we also back them up in Vault or encrypted in SeaweedFS.
- [ ] Figure out what else we need if we want to support non-route53 issuing.