Make the cloudflared tunnel service use systemd credentials and dynamic users, removing the services.cloudflared.user and .group option. Also add an option to provide the cert.pem file, without which tunnels defined declaratively would not work. Additionally, add an assertion checking that the certificate file is provided if there are declarative routes defined.