feat(controller): teach controller about application certificates

supercedes #2570, rebased and all comments addressed.
@nathansamson not sure if I understand your question. You mean for applications which have added additional domains via `deis domains:add`? If that's the case, `deis certs` locks down all of the CNAME records under the SSL cert, and it only has support for 1 certificate with how it's laid out.