Add DNSimple, Linode, Porkbun, Bunny, Azure DNS and Alibaba Cloud DNS providers

[mhenrixon]

Problem

Completes the curated batch: the remaining registrars and cloud DNS services common in the kamal audience that lego already supports.

Scope

Verified present in the pinned lego v4.30.1:

Provider	lego package	Required env	Optional env
DNSimple	providers/dns/dnsimple	DNSIMPLE_OAUTH_TOKEN	DNSIMPLE_BASE_URL, DNSIMPLE_TTL, DNSIMPLE_PROPAGATION_TIMEOUT, DNSIMPLE_POLLING_INTERVAL
Linode	providers/dns/linode	LINODE_TOKEN	LINODE_TTL, LINODE_PROPAGATION_TIMEOUT, LINODE_POLLING_INTERVAL, LINODE_HTTP_TIMEOUT
Porkbun	providers/dns/porkbun	PORKBUN_API_KEY + PORKBUN_SECRET_API_KEY	PORKBUN_TTL, PORKBUN_PROPAGATION_TIMEOUT, PORKBUN_POLLING_INTERVAL, PORKBUN_HTTP_TIMEOUT
Bunny	providers/dns/bunny	BUNNY_API_KEY	BUNNY_TTL, BUNNY_PROPAGATION_TIMEOUT, BUNNY_POLLING_INTERVAL, BUNNY_HTTP_TIMEOUT
Azure DNS	providers/dns/azuredns	AZURE_SUBSCRIPTION_ID + AZURE_RESOURCE_GROUP (auth via AZURE_TENANT_ID + AZURE_CLIENT_ID + AZURE_CLIENT_SECRET, or workload-identity/MSI)	AZURE_ENVIRONMENT, AZURE_ZONE_NAME, AZURE_PRIVATE_ZONE, AZURE_AUTH_METHOD, OIDC vars, AZURE_TTL, …
Alibaba Cloud	providers/dns/alidns	ALICLOUD_ACCESS_KEY + ALICLOUD_SECRET_KEY, or ALICLOUD_RAM_ROLE	ALICLOUD_SECURITY_TOKEN, ALICLOUD_REGION_ID, ALICLOUD_TTL, …

Acceptance criteria

• GIVEN each provider's required credentials WHEN --acme-dns-provider <name> is set THEN the challenge provider is built and auto-detection also finds it
• GIVEN partial credentials THEN the error names the missing variables
• GIVEN ALICLOUD_RAM_ROLE alone (no access key pair) THEN the provider builds — the alternative path is honoured
• GIVEN Azure with MSI/workload identity and no client secret THEN the credential check does not reject it

Notes

Depends on the registry refactor.

Azure and Alibaba are the two with genuinely complex credential shapes — Azure supports five auth methods and Alibaba two. Model only what the registry can express honestly: if a provider's rule cannot be reduced to "one of these env sets is present", prefer delegating to lego's own NewDNSProvider() error rather than encoding a check that will be wrong. A misleading "missing credentials" message is worse than lego's real one.

Record the go build size delta in the PR, same as the European batch.