haproxy: Run as haproxy user, not nobody

Fix permissions on the TLS certificate and run the HAProxy service as
the haproxy user and group. This is a limited account created via the
haproxy package.

Explicitly define the PIDFILE to be used to override and default which
may change between the service script and haproxy.cfg.