Allow service certificates to have Common Names that are not the hostname

Currently, if a service certificate is not issued for the server's hostname, that certificate is reset during upcp. This should be configurable, preferably directly on the service certificates page, but otherwise in Tweak Settings.

Ideally, it would have three options: do not check certificate names, reset certificates not issued for the hostname, and reset certificates not issued to custom hostname (and a field to enter the custom hostname).