[renew-cert] Check for the existing cert's revocation

[Arnavion]

... not just its expiry time.

A crate like x509-parser can be used to get the OCSP URL. But there's no pure-Rust crate (ie, not openssl) to do OCSP, so the function would need to talk the OCSP protocol manually with something like der.

Ref:

• X.680 - ASN.1

• X.690 - ASN.1 BER and DER encodings

• RFC6960 - OCSP , especially Appendix A for OCSP-over-HTTP

[Arnavion]

LE is planning to sunset OCSP in favor of CRLs.

But also, Let's encrypt confirmed here that ARI will return a suggested window of "right now" for a revoked cert, so there's no need to check revocation separately anyway.