README missing coverage of SANs entries validation

[atc0005]

The lscert tool and the check_cert plugin both accept a CSV list of expected SANs entries and assert that:

• all provided SANs entries are present on the leaf certificate
• all SANs entries present on the leaf certificate are in the provided SANs entries list

This covers these scenarios:

• the cert provider omitted a requested/expected SANs entry
• the monitoring configuration has not been updated to look for new SANs entries present on the leaf cert

The README should ideally reflect both scenarios.