Bundle certbot's DH parameters as a resource instead of downloading them

certbot removed ssl-dhparams.pem from its repository, so the managed-nginx
startup failed with HTTP 404 on fresh installations (the legacy script only
kept working through its year-old state-dir cache). The RFC 7919 ffdhe2048
parameters are now a classpath resource; the download seam and
NginxConfigFiles.DH_PARAMS_URL are gone.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/test/kotlin/de/hoennig/gittally/server/NginxProxyManagerTest.kt

@@ -126,7 +126,6 @@ class NginxProxyManagerTest : FunSpec() {
             }
             manager = NginxProxyManager(commandRunner, configLoader)
             manager.workingDir = repoDir
-            manager.dhParamsDownloader = { Files.writeString(it, "dh-params") }
             manager.sleeper = { sleepCount++ }
         }
 
@@ -198,7 +197,8 @@ class NginxProxyManagerTest : FunSpec() {
                     "--register-unsafely-without-email",
                 )
             Files.readString(stateDir.resolve("certbot/conf/options-ssl-nginx.conf")) shouldBe NginxConfigFiles.SSL_OPTIONS
-            Files.readString(stateDir.resolve("certbot/conf/ssl-dhparams.pem")) shouldBe "dh-params"
+            // the bundled RFC 7919 ffdhe2048 parameters, vendored because certbot removed the download
+            Files.readString(stateDir.resolve("certbot/conf/ssl-dhparams.pem")) shouldContain "BEGIN DH PARAMETERS"
         }
 
         test("start with an existing certificate uses the full config immediately and renews") {