fix(certificatee): match haproxy certs by SAN

[ananthb]

Summary

• collect Vault lookup candidates from live HAProxy SANs, then filename fallback
• require the selected Vault certificate DNS names to match the full live HAProxy SAN set before writing
• update the exact HAProxy certificate name already present instead of creating or deleting aliases
• keep filename fallback for certificates without SAN metadata
• add coverage for multi-SAN matching and sanitized/legacy filename replacement behavior

This means an existing HAProxy certificate such as certs/_.nodes.rpcpool.com.pem or certs/__nodes_rpcpool_com.pem is replaced in place after certificatee finds a Vault bundle whose SAN set matches the live HAProxy certificate.

No Linear ticket - incident follow-up.

Validation

• /usr/local/go/bin/go test ./...
• git diff --check