Add a program for lego's exec DNS provider

contrib/lego/jarl-lego.sh turns lego's "present|cleanup FQDN VALUE" calls
into jarl acme set|unset --exact, so lego (and CNAME delegation to a
dedicated ACME zone) works with Jarl. docs/acme.md explains the setup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/development.md

@@ -26,6 +26,7 @@ internal/
   config/             jarld's YAML configuration
 deploy/               systemd unit, sysusers.d and tmpfiles.d files
 contrib/acme.sh/      acme.sh DNS API hook
+contrib/lego/         program for lego's exec DNS provider
 scripts/e2e.sh        end-to-end test against a real named
 ```