SA/ARI: Add method of tracking certificate replacement

[beautifulentropy]

Part of #6732
Part of #7038

[github-actions]

@beautifulentropy, this PR appears to contain configuration changes. Please ensure that a corresponding deployment ticket has been filed with the new configuration values.

[pgporada]

You'll need to fix the spelling errors found by typos and regenerate the protobufs because of the comment change.

[beautifulentropy]

Converting to draft while I make some changes to the schema.

[aarongable]

Primary logic LGTM. We're missing unit tests for the new functions in model.go. In particular, I think it's important to have tests for

• addReplacementOrder working in both the normal and the already-exists cases; and
• setReplacementOrderFinalized working both when there's a row to update and when there isn't one.

[beautifulentropy]

Primary logic LGTM. We're missing unit tests for the new functions in model.go. In particular, I think it's important to have tests for

• addReplacementOrder working in both the normal and the already-exists cases; and
• setReplacementOrderFinalized working both when there's a row to update and when there isn't one.

I'm pretty sure that I've got coverage for these cases in the existing SA unit test. I'd happily break that out into the model.go test explicitly though.

[aarongable]

Yeah, I think it'd be much clearer to have individual tests for addReplacementOrder and setReplacementOrderFinalized.