Add a 'manual' Certificate implementation

We should add the ability to paste a CA certificate into the front-end. It should presumably look something like:

Ideally we'd also:

Generate the key/CSR.
Validate the certs(s) in the front-end.
Expunge the key from the front-end DB.
Notify when a certificate is coming due for renewal (this could be implemented as a hosting_probe)

For background, see #2 (closed).