Ensure that subdirectory sites work properly with Let's Encrypt

Over in #3036890: Simplify subdir site installation, we drastically simplified subdir site installation, which should, hopefully, encourage more use of that feature. However, I'm not at all certain that LE certificate generation will work in that context. We should check.

Basically, if you want to install a site using a subdirectory URL, we now just use it as the site domain, as normal. We then re-write it to a sub-domain (example.com/site1 becomes site1.example.com), and add an alias for the subdir URL, and redirect to it.

I think that hosting_https will only look at the site's URL, which is technically site1.example.com, in this example. However, the site user clearly wants example.com/site1 to be canonical. In fact, site1.example.com might not even have a DNS entry pointing to the server.

We'll have to work out some potentially tricky behaviour. For example, I think we'll need to use the base domain here (ie, example.com) for the certificate, but that'll be the same for multiple sites (eg, example.com/site2). Likewise, where does the .well-know directory and LE token get installed?

Anyway, I'll be very happily surprised if this works at present. If not, maybe I'm over-thinking it. Either way, it'll need some testing to validate.