Add a program for lego's exec DNS provider

contrib/lego/jarl-lego.sh turns lego's "present|cleanup FQDN VALUE" calls
into jarl acme set|unset --exact, so lego (and CNAME delegation to a
dedicated ACME zone) works with Jarl. docs/acme.md explains the setup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -46,7 +46,7 @@ error: www.adbraun.lol has a CNAME, so it can't have any other records (found A)
   queries, record types, cache hit rate. Shown in the web UI and the CLI,
   and exportable as JSON. Stored as aggregates in a separate database with
   retention you set.
-* **Let's Encrypt DNS-01** built in: `jarl acme` plus certbot and acme.sh
+* **Let's Encrypt DNS-01** built in: `jarl acme` plus certbot, acme.sh and lego
   hooks, including CNAME delegation to a dedicated ACME zone.
 * **Adopts an existing server**: imports named.conf and zone files
   (comments included), then switches named over with an automatic
@@ -88,7 +88,7 @@ in `/etc/jarl/jarl.yaml` to reach it from your management network.
 | [docs/api.md](docs/api.md) | REST API reference |
 | [docs/permissions.md](docs/permissions.md) | Users, tokens, grants and roles |
 | [docs/views.md](docs/views.md) | Split DNS: adding views to a server that has none |
-| [docs/acme.md](docs/acme.md) | Let's Encrypt DNS-01 with certbot and acme.sh |
+| [docs/acme.md](docs/acme.md) | Let's Encrypt DNS-01 with certbot, acme.sh and lego |
 | [docs/stats.md](docs/stats.md) | Query statistics: enabling, what is collected, retention |
 | [docs/validation.md](docs/validation.md) | Every check Jarl makes |
 | [docs/operations.md](docs/operations.md) | Backups, drift, failures, recovery, monitoring |