feat: CERTBOT_DOMAIN may name several domains

certbot's own -d already takes a comma-separated list and puts every name
in the certificate's Subject Alternative Names, so `-d "$CERTBOT_DOMAIN"`
needed no change at all. What assumed a single domain was everything that
treated the variable as a *file name*: --cert-name, and the two scripts
that address the lineage under /etc/letsencrypt/live. Certbot names a
lineage after the first domain of the list, so all three now take
${CERTBOT_DOMAIN%%,*} instead of the whole string -- otherwise a two-domain
value asks for a lineage literally called "a.org,b.org" and the renewal
pass looks for a directory nobody made.

One certificate with several names rather than several lineages: HAProxy
binds a single site.pem, and a second lineage would have nowhere to go.

Adding a domain to CERTBOT_DOMAIN on a machine that already holds a
certificate still needs one manual issuance -- `certbot renew` reads the
names off the certificate it has and never looks at the variable. The
README says so, and gives the command.

docker/scripts/2-concatenate-cert.sh

@@ -8,7 +8,7 @@
 # the tests below looking for fullchain.pem in whatever directory the caller
 # happened to be in.
 
-live="/etc/letsencrypt/live/$CERTBOT_DOMAIN"
+live="/etc/letsencrypt/live/${CERTBOT_DOMAIN%%,*}"
 
 if [ -f "$live/fullchain.pem" ] && [ -f "$live/privkey.pem" ]; then
   # Through a temporary file, then an atomic rename: HAProxy reads site.pem at