fully automate lets encrypt certs for haproxy load balancer

[ewdurbin]

currently we have renewals.sh and certs.sh on salt.nyc1.psf.io which handle renewals.

we should move this handling into salt-master's states.