Use lego binary to handle HTTP-01 challenge

[accuser]

Since #1753 the DNS-01 challenge is handled with the lego binary. HTTP-01 challenge can also now be handled with the lego binary.

Proposed changes:

• Add core.http_address to config.
• Add well-known HTTP server to incusd that is enabled when core.http_address is valid. This new server simply serves files from the .well-known subfolder of var root (i.e., /var/lib/incus).
• When updating certificates using HTTP-01 challenge, call lego with the --http.port [port] --http.webroot [webroot] settings so that the challenge token is written to the file system folder [webroot]/.well-known/acme-challenge/ and available via http://[domain]:[port]/.well-known/acme-challenge/[token]

I have this as a PoC in a local branch, but want to sense check this approach first before submitting a PR @stgraber.

[stgraber]

SO in general, we don't want Incus to have an HTTP listener, we only do HTTPS.

Can lego itself run the http server during validation?

[accuser]

It can - I'm just testing now. If this works, I'll submit a PR shortly.

[accuser]

I've just submitted PR #1770, now with no HTTP serving .well-known files. 😉