Certificate base path location is not respected when credential is regenerated

Problem/Motivation

When a custom certificate path is configured and a credential is renewed on the UI, the backup is created outside the base path of the custom certificate path.

If the complete private:// is under automated backup with an exception for a particular subfolder where Lockr certificates are stored there, then when the credential renewal process bypasses the preconfigured credential location and stores a copy of new certificate and the backup in private://lockr/... then it can lead to unexpected problems.

Steps to reproduce

Proposed resolution

Most probably, this problem's roots rely on https://git.drupalcode.org/project/lockr/-/blob/4.0.1/src/CertManager.ph... because it has a hardcoded base dir for certificates.

Maybe the Custom certificate path should be split into two configuration options, one for the base dir and another for a custom certificate file name (if that is truly necessary).

Remaining tasks

User interface changes

API changes

Data model changes