Allow configuring the Certbot executable path

Is your feature request related to a problem? Please describe.

The core Let's Encrypt script invokes Certbot using the absolute path /opt/certbot/bin/certbot.

This path works in the Azure TRE development container because its Dockerfile installs Certbot there. However, make letsencrypt cannot run in an alternative environment where Certbot is installed elsewhere.

Configuring PATH does not help because the script uses an absolute path. Installing or linking Certbot under /opt may also require root access.

Describe the solution you'd like

Allow the Certbot executable path to be supplied through an optional CERTBOT_BIN environment variable.

For example:

CERTBOT_BIN=/path/to/certbot make letsencrypt

The script should continue to use /opt/certbot/bin/certbot when CERTBOT_BIN is unset. This preserves the existing development-container behaviour.

Describe alternatives you've considered

• Install Certbot under /opt/certbot. This may require root access and duplicates an existing installation.
• Create a symbolic link under /opt/certbot/bin. This also requires permission to modify /opt.
• Modify the script locally. This creates unnecessary differences from upstream Azure TRE.
• Add the Certbot installation directory to PATH. This does not override the current absolute path.

Additional context

The proposed change applies only to the core make letsencrypt workflow.

The certificate shared-service container should remain unchanged because its Dockerfile installs Certbot at /opt/certbot/bin/certbot.

The requested behaviour is backwards-compatible:

• If CERTBOT_BIN is set, use its value.
• If CERTBOT_BIN is unset, use /opt/certbot/bin/certbot.