Allow for removal of ENX redirect domains

[mikehelmick]

TL;DR

Allow for removal of ENX redirect domains (for turned down or never launched regions).

Design

In the terraform add a new set, the enx_redirect_domain_map_remove set. These domains are removed from the next certificate.

Just like with additions, there need to be a 2 step process (1) provision the next cert w/ the domains removed and then (2) rotate the certificates once the next one is fully provisioned.

[mikehelmick]

low priority, writing this down so I don't forget

[mikehelmick]

We can safely close this now - we haven't run into any installations (that we are aware of) that are near the certificate limit and would require removal.