Investigate dropping the certificateStatus table

[aarongable]

This table was primarily used for OCSP; our CRL systems instead use the revokedCertificates table. With OCSP shutting down, let's identify all other code which uses the certificateStatus table, and see what work is necessary to drop this table entirely.

[aarongable]

Uses of certificateStatus in sa.go:

• SetCertificateStatusReady, which was only needed in the OCSP world
• AddPrecertificate, which is the whole point of this investigation
• RevokeCertificate, which is also the whole point of this investigation
• UpdateRevokedCertificate, which is also also the whole point of this investigation

Uses of certificateStatus in saro.go and model.go:

• GetCertificateStatus, via SelectCertificateStatus; see below
• GetRevocationStatus, via SelectRevocationStatus; this should be updated to read from the revokedCertificates table, since it only returns a small set of metadata which that table holds
• GetMaxExpiration, see below

Uses of GetCertificateStatus:

• ra.go:updateRevocationForKeyCompromise, which could use GetRevocationStatus instead
• ra.go:AdministrativelyRevokeCertificate, which uses the certificateStatus table to get the IssuerID for a malformed cert. This cannot be replaced by any other table today.
• wfe.go:determineARIWindow, which could use GetRevocationStatus instead

Uses of GetMaxExpiration:

• updater.go:getShardMappings, which is only used by the temporal sharding path, so can be removed

In summary:

1. We should rewrite GetRevocationStatus/SelectRevocationStatus to use the newer revokedCertificates table, and migrate most consumers of GetCertificateStatus to use GetRevocationStatus instead.
2. Once that's done, we can stop updating the table during RevokeCertificate and UpdateRevokedCertificate.
3. We should figure out a new place to store the IssuerID of every cert, for use in AdministrativelyRevokeCertificate.
4. And then finally we can stop writing to the certificateStatus table during AddPrecertificate, and drop it entirely.

[aarongable]

Updates, checking off boxes above as these changes are made:

• SA: Stop supporting OCSP status NotReady #8395 resolves SetCertificateStatusReady
• Remove support for temporally-sharded CRLs #8400 and Delete sa.GetMaxExpiration and sa.GetRevokedCerts #8401 resolve GetMaxExpiration
• Use GetRevocationStatus instead of GetCertificateStatus #8402 resolves SelectRevocationStatus/GetRevocationStatus, updateRevocationForKeyCompromise, and determineARIWindow