Monitor .onion TLS certificate expiry

Currently we have one .onion certificate, from Harica, deployed for forum.torproject.org

Unlike other TLS certificates we deloy, we don't have monitoring on this certificate, we only receive mail notifications from Harica warning us of the upcoming expiry.

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information