Add certificate and key configuration from files

[mcpherrinm]

While ACME is usually a good option, it's not always available.

This makes the ACME section optional and provides an alternative TLS section with a cert and key file.

[mcpherrinm]

I see the race detector firing on the previous commit, so it's unrelated to this PR (edit: merged the fix in from main)

[FiloSottile]

I am not a fan of supporting certificate loading without an option to rotate it, and implementing SIGHUP machinery for tests feels overkill. A pattern I use in these cases is adding a -testcert flag which reads from a couple of hardcoded paths, which makes it inconvenient enough to discourage production use. How's #5?

[mcpherrinm]

That’s fine by me. I haven’t seen that pattern before but it makes sense.