feat(controller): teach controller about application certificates

supercedes #2570, rebased and all comments addressed.
@nathansamson That's a valid point. Certs are really tied to domains, not apps - when I remove a domain, a cert that validates for that domain should also be removed.

But then what about the case for wildcard certs? Should those be treated differently?