also free SSL certificate when SSL is disabled on a site

otherwise the site would hold onto that certificate (and therefore the
server IP) even if SSL was disabled
reformat complex query to be more readable
fix SSL certificate garbage collection, it was simply not working

this was tricky. the first step was to cleanup the SSL certs *before*
we edit the site metadata, otherwise we would have simply lost the
cert identifier, because it's not in the $node object.

next, the query that detects related certificates had to be fixed to
ignore the site itself, since it was still present.

finally, we need to explicitely fetch that value from the database.

we add an extra SELECT here, which is suboptimal - we should be able
to extract all the data we need earlier, but this is clearer for now.