Replace the stub OCSP implementation with a fully functional RFC 6960
compliant revocation checker that:
- Builds OCSP requests using SHA-1 hashes of issuer name/key via the
ocsp crate's CertId and OneReq types with proper DER encoding
- Sends requests via HTTP POST with correct Content-Type headers
- Parses DER-encoded OCSP responses to extract response status
(successful/malformed/internal-error/try-later/unauthorized)
- Determines certificate status (Good/Revoked/Unknown) by locating
the serial number and scanning for ASN.1 context-specific tags
- Caches results in the existing LRU cache with TTL
- Increments Prometheus metrics for all failure paths
80099a6799