fix(ssl): honor updated le-mail on certificate renewal

[mrrobot47]

Problem

On renewal, getOrCreateDistinguishedName() rebuilt the CSR's distinguished name using the stored email (from first issuance) and ignored the le-mail value, and executeRenewal() re-read le-mail from config.yml instead of using the email passed to request(). So after changing le-mail, renewal CSRs and the stored distinguished_name.json kept the original address. Note: Let's Encrypt drops CSR subject fields other than the CN, so the email never appears in issued certificates, and the ACME account contact is not updated by this change (that would need an account update).

Fix

When a stored distinguished name exists, use the passed $email if it is non-empty, falling back to the stored email only when none is provided. The updated DN is persisted as before, so the new email sticks for future renewals. All other DN fields and the SAN list are unchanged.

Testing

Manual: change le-mail, force a renewal → the CSR subject and acme-conf/var/<domain>/distinguished_name.json carry the new email; --le-mail=<x> on ssl-renew is honoured too; with an empty le-mail, the DN falls back to the stored address.

Tested on PHP 7.4 and 8.5 by running the real renewal code against a stub ACME client and capturing the CSR (new, runtime and empty emails), and on Ubuntu 26.04 with EasyEngine 4.12.0 for regressions (self-signed create, ssl-renew --all, ssl-renew on a non-LE site).

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.