docs(defaults): update pillar.example to good-citizen defaults

Specifying `renew-by-default` in the config, regardless of True / False enables the flag.
This causes certbot to force-renew on every timer run and means you will hit the rate-limit
fairly quickly. A safer default is `keep-until-expiring` where the renew will only be done
when it's actually advisable.

`expand` allows an expanded domain list to renew correctly without forking a new domainset.
This is something that most users will want.

pillar.example

@@ -21,7 +21,8 @@ letsencrypt:
     authenticator = webroot
     webroot-path = /var/lib/www
     agree-tos = True
-    renew-by-default = True
+    keep-until-expiring = True
+    expand = True
   config_dir:
     path: /etc/letsencrypt
     user: root