Use cloudflare managed certificate for ops.gitlab.net

We have certificates-updater which automates renewing certs from SSLMate and pushing them into HAProxy.

However, this does not cover cloudflare, which is still manual.

If we are able to transition to fully managed certs on ops.gitlab.net, that'd remove another source of toil.

We'd likely need a wildcard cert for *.ops.gitlab.net -- we should check if it is possible to get that from CF.