Merge pull request letsencrypt#1232 from letsencrypt/caa-fix

Invalidate challenge on CAA failure