ARI: Implement ARI POST with a new Order object field

[beautifulentropy]

This change is specified in aarongable/draft-acme-ari#51.

• Keep existing POST-as-GET to renewalInfo endpoint implementation intact.
• Extend the existing newOrder request with a "replaces" field that is expected to be a "CertID" as detailed in https://datatracker.ietf.org/doc/html/draft-ietf-acme-ari-02#section-4.1
• If the order is a replacement order, then we need to check that:
  • the certificate being replaced exists,
  • the requesting account owns that certificate, and
  • the names in this new order match the names in the certificate being replaced.
• Once the above conditions are satisfied:
  • Indicate in the NewOrder request dispatched to the RA that this order should bypass rate limits.
  • (future) Mark this certificate as "replaced" in any existing incidents tables.

WFE implementation should look something like:

	var newOrderRequest struct {
		Identifiers                   []identifier.ACMEIdentifier `json:"identifiers"`
		NotBefore, NotAfter, Replaces string
	}

	...

	if newOrderRequest.Replaces != "" {
		// If the order is a replacement order, then we need to check that:
		//   - the certificate being replaced exists,
		//   - the requesting account owns that certificate, and
		//   - the names in this new order match the names in the certificate
		//     being replaced.
		certID, prob, err := newCertID(newOrderRequest.Replaces, wfe.issuerCertificates)
		if err != nil {
			wfe.sendError(response, logEvent, prob, err)
		}
		cert, err := wfe.sa.GetCertificate(ctx, &sapb.Serial{Serial: certID.Serial()})
		if err != nil {
			if errors.Is(err, berrors.NotFound) {
				wfe.sendError(response, logEvent, probs.NotFound("Certificate replaced by this order does not exist"), nil)
			} else {
				wfe.sendError(response, logEvent, web.ProblemDetailsForError(err, "Failed to retrieve certificate  replaced by this order"), err)
			}
			return
		}
		if cert.RegistrationID != acct.ID {
			wfe.sendError(response, logEvent, probs.Unauthorized("Account does not own certificate replaced by this order"), nil)
			return
		}
		var namesMatch bool
		parsedCert, err := x509.ParseCertificate(cert.Der)
		if err != nil {
			wfe.sendError(response, logEvent, probs.ServerInternal("Error parsing certificate replaced by this order"), err)
			return
		}
		for _, name := range core.UniqueLowerNames(names) {
			if !slices.Contains(parsedCert.DNSNames, name) {
				namesMatch = false
				break
			}
			namesMatch = true
		}
		if !namesMatch {
			wfe.sendError(response, logEvent, probs.Malformed("Certificate replaced by this order does not have matching identifiers"), nil)
			return
		}
		bypassLimits = true
	}

	order, err := wfe.ra.NewOrder(ctx, &rapb.NewOrderRequest{
		RegistrationID: acct.ID,
		Names:          names,
		BypassLimits:   bypassLimits,
	})