Checklist

Before submitting the PR, ensure the following tasks are completed. If an item is not applicable to your PR, please mark it as checked:

• The changelog has been updated in the relevant commit(s) according to the guidelines.
• Tests have been added or modified to reflect the changes.
• Documentation has been reviewed and updated as needed.
• Related issues have been listed and linked, including any that this PR closes.

Adds some additional documentation around generating custom gRPC SSL certificates.

1. Fixes anchor links to point to the gprc page instead of redirecting to app-development.
2. Adds a clarifying example depicting that "lightning" directory should actually be the network subdirectory, as certs are stored there.
3. Adds an additional section of documentation for generating SSL certificates using Subject Alternative Names.

Context

After struggling with properly generating custom certificates for a long time while trying to run the API under both Tor and SSL, as well as allow another local service to communicate with the gRPC APIs, I'm submitting the process that worked for me as candidate for documentation improvements. From memory, the problematic issues were:

1. Generating new certificates using the existing documentation didn't preserve the SAN from the original default certificate, including localhost, 127.0.0.1 and cln etc.
2. Generating a new certificate using the existing documentation suggests to use CN for the "production" domain, but browsers and other common SSL client libraries complain that verification via SAN is required and throw an error (as of circa 2017?).

Caveat

Not exactly an SSL expert here, so a review on best practices would be appreciated. I used the following resources to assemble this solution:

• https://docs.corelightning.org/docs/grpc
• https://gist.github.com/yidas/af42d2952d85c0951c1722fcd68716c6
• https://docs.openssl.org/3.0/man1/openssl-req/#configuration-file-format

Also, this page suggests it could be possible to do this with a one-liner due to this openssl commit. Just saying, there may be a better way to do this.