Add support for "legacy" RSA 4096 certs

• certificate: Allow passing an explicit name
  Don't require the cert to have the same name as the first domain.

• certificate: Allow creating legacy certs
  With RSA 4096 instead of ECDSA.

• maintenance: Simplify template

• maintenance: Don't use permanent redirects
  They might conflict with the normal configuration, so we don't want these redirects to get cached.

• archweb: Add support for legacy domains
  Using a cert named after the primary domain with _legacy appended. However, the cert is only issued for the legacy domains, not the primary domain.

  Deploy for ipxe.archlinux.org.

  Fixes: releng#22 (closed)