ra: revoke with explicit CRL shard

[jsha]

In RA.RevokedCertificate, if the certificate being revoked has a crlDistributionPoints extension, parse the URL and pass the appropriate shard to the SA.

This required some changes to the admin tool. When a malformed certificate is revoked, we don't have a parsed copy of the certificate to extract a CRL URL from. So, specifically when a malformed certificate is being revoked, allow specifying a CRL shard. Because different certificates will have different shards, require one-at-a-time revocation for malformed certificates.

To support that refactoring, move the serial-cleaning functionality earlier in the admin tool's flow.

Also, split out one of the cases handled by the revokeCertificate helper in the RA. For admin revocations, we need to accept a human-specified ShardIdx, so call the SA directly in that case (and skip stat increment since admin revocations aren't useful for metrics). This allows revokeCertificate to be a more helpful helper, by extracting serial, issuer ID, and CRL shard automatically from an *x509.Certificate.

Note: we don't yet issue certificates with the crlDistributionPoints extension, so this code will not be active until we start doing so.

Part of #7094.