This makes HTTP challenges work on https://http2.golang.org/ since
LetsEncrypted disabled the TLS-SNI challenges.

Also, move it from a systemd unit on CoreOS to GKE.

Updates golang/go#23627
Fixes golang/go#23034

Change-Id: Id8348e9e56ab43e277f1e12d563fd8fc490d6211
Reviewed-on: https://go-review.googlesource.com/91495Reviewed-by: Andrew Bonventre <andybons@golang.org>