People assume that time is a strict progression of cause to effect, but
actually, from a nonlinear, non-subjective viewpoint, it's more like a
big ball of wibbly-wobbly, timey-wimey... stuff.
This introduces a small new package, `precert`, with one function
`Correspond` that checks a precertificate against a final certificate to
see if they correspond in the relationship described in RFC 6962.
This also modifies the `issuance` package so that RequestFromPrecert
generates an IssuanceRequest that keeps a reference to the
precertificate's bytes. The allows `issuance.Prepare` to do a
correspondence check when preparing to sign the final certificate. Note
in particular that the correspondence check is done against the
_linting_ version of the final certificate. This allows us to catch
correspondence problems before the real, trusted signature is actually
made.
Fixes#6945
Aaron Gable
Jacob Hoffman-Andrews