Automate renewal of self-signed LDAP cert

In #41479 (closed) I renewed the self-signed LDAP cert for two years (730 days). That means that next time we renew it will be right after the holidays in 2026. It's not too much of a pain since it's only every 2 years, but it would be nice to not have to renew it right after we come back from our holiday break.

We could either automate the procedure entirely, or I could renew it again in a month or so so that the current cert will expire in February 2026. @anarcat any preferences or suggestions?