feat: CERTBOT_DOMAIN may name several domains

certbot's own -d already takes a comma-separated list and puts every name
in the certificate's Subject Alternative Names, so `-d "$CERTBOT_DOMAIN"`
needed no change at all. What assumed a single domain was everything that
treated the variable as a *file name*: --cert-name, and the two scripts
that address the lineage under /etc/letsencrypt/live. Certbot names a
lineage after the first domain of the list, so all three now take
${CERTBOT_DOMAIN%%,*} instead of the whole string -- otherwise a two-domain
value asks for a lineage literally called "a.org,b.org" and the renewal
pass looks for a directory nobody made.

One certificate with several names rather than several lineages: HAProxy
binds a single site.pem, and a second lineage would have nowhere to go.

Adding a domain to CERTBOT_DOMAIN on a machine that already holds a
certificate still needs one manual issuance -- `certbot renew` reads the
names off the certificate it has and never looks at the variable. The
README says so, and gives the command.

docker/scripts/0-create-cert.sh

@@ -51,7 +51,7 @@ if [ -n "$CERTBOT_DOMAIN" ]; then
   certbot certonly --standalone \
     --non-interactive --agree-tos --http-01-port=380 \
     "$@" \
-    --cert-name "$CERTBOT_DOMAIN" \
+    --cert-name "${CERTBOT_DOMAIN%%,*}" \
     -d "$CERTBOT_DOMAIN"
 
   # Concatenate certificates

docker/scripts/1-renew-cert.sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 
 # Certificates exist
-if [ -n "$CERTBOT_DOMAIN" -a -d /etc/letsencrypt/live/"$CERTBOT_DOMAIN" ]; then
+if [ -n "$CERTBOT_DOMAIN" -a -d /etc/letsencrypt/live/"${CERTBOT_DOMAIN%%,*}" ]; then
   # Check certificates and renew them
   certbot renew --http-01-port=380
 

docker/scripts/2-concatenate-cert.sh

@@ -8,7 +8,7 @@
 # the tests below looking for fullchain.pem in whatever directory the caller
 # happened to be in.
 
-live="/etc/letsencrypt/live/$CERTBOT_DOMAIN"
+live="/etc/letsencrypt/live/${CERTBOT_DOMAIN%%,*}"
 
 if [ -f "$live/fullchain.pem" ] && [ -f "$live/privkey.pem" ]; then
   # Through a temporary file, then an atomic rename: HAProxy reads site.pem at