Add pip-in-venv install method, deprecate source install

certbot-auto was removed from the certbot repo by EFF in 2021 (see issue
#204), which leaves certbot_install_method: source broken — the existing
install-from-source.yml still references {{ certbot_dir }}/certbot-auto,
a path that no longer exists after the git clone.

This adds a new install method `pip` that follows EFF's recommended
install path (https://certbot.eff.org/instructions?os=pip): create a
Python venv at {{ certbot_dir }}, pip install certbot, symlink the
binary onto PATH at /usr/local/bin/certbot.

Plugins (e.g. certbot-dns-rfc2136, certbot-dns-cloudflare) can be
opted into per-host via a new certbot_pip_extra_packages list, which
installs additional pip packages into the same venv after certbot.

The legacy `source` method is left in place for backwards compatibility
but is now documented as deprecated in the README and defaults file.

Tested on Debian 12 and Debian 13.

defaults/main.yml

@@ -58,13 +58,23 @@ certbot_create_standalone_stop_services:
   # - apache
   # - varnish
 
-# Available options: 'package', 'snap', 'source'.
+# Available options: 'package', 'snap', 'source', 'pip'.
+# Note: 'source' is deprecated — it relies on certbot-auto, which EFF removed
+# from the certbot repo in 2021. Use 'pip' for the equivalent always-latest
+# install (creates a venv at {{ certbot_dir }} and pip-installs certbot).
 certbot_install_method: 'package'
 
-# Source install configuration.
+# Source / pip install configuration.
 certbot_repo: https://github.com/certbot/certbot.git
 certbot_version: master
 certbot_keep_updated: true
 
-# Where to put Certbot when installing from source.
+# Where to put Certbot when installing from source or pip (venv root for pip).
 certbot_dir: /opt/certbot
+
+# Extra pip packages installed alongside certbot in the same venv (pip method only).
+# Use this for plugins, e.g.:
+#   certbot_pip_extra_packages:
+#     - certbot-dns-rfc2136
+#     - certbot-dns-cloudflare
+certbot_pip_extra_packages: []