refactor: make a clear distinction between certbot and lego

Use separate paths for certbot and lego when obtaining certificates. Also
change location for dns-challenge system unit and remove some default values.
Furthermore, update README accordingly.