This is a first aproximation to a solution.

It's a bit brute force - mount a config map in the pod with a script to
run at renewal time.

I'll need to update controller to check for an attribute (that specifies
a script path) so the voulmeMount is only inserted if there's a good
chance that it's going to work.

Bring in upstream changes

If a pod is annotated with `autocert.step.sm/renewalVolume: script',
then controller will add a volume map to the named volume to the renewal
container.