Generate a self-signed cert when none is provided

The documentation suggested doing this manually, but this is better because it does it for you!
For a future PR, let's move the keys to one folder (both the .key and the .crt), and let's put it in a place that's recommended by dovecot, which I believe @al3x also created an issue for in sovereign.