caddytls: Add support for ZeroSSL; add Caddyfile support for issuers

[mholt]

Configuring issuers explicitly in a Caddyfile is not easily compatible
with existing ACME-specific parameters such as email or acme_ca which
infer the kind of issuer it creates (this is complicated now because
the ZeroSSL issuer wraps the ACME issuer)... oh well, we can revisit
that later if we need to.

New Caddyfile global option:

{
    cert_issuer <name> ...
}

Or, alternatively, as a tls subdirective:

tls {
    issuer <name> ...
}

For example, to use ZeroSSL with an API key:

{
    cert_issuser zerossl API_KEY
}

For now, that still uses ZeroSSL's ACME endpoint; it fetches EAB
credentials for you. You can also provide the EAB credentials directly
just like any other ACME endpoint:

{
    cert_issuer acme {
        eab KEY_ID MAC_KEY
    }
}

All these examples use the new global option (or tls subdirective). You
can still use traditional/existing options with ZeroSSL, since it's
just another ACME endpoint:

{
    acme_ca  https://acme.zerossl.com/v2/DV90
    acme_eab KEY_ID MAC_KEY
}

That's all there is to it. You just can't mix-and-match acme_* options
with cert_issuer, because it becomes confusing/ambiguous/complicated to
merge the settings.

---

The latest commits on this PR make it possible to implicitly configure the ZeroSSL issuer by specifying a CA endpoint containing acme.zerossl.com and an email address; no API key required:

{
    acme_ca https://acme.zerossl.com/v2/DV90
    email   [email protected]
}

(And similarly for with the tls directive.)

In other words, even though using ZeroSSL (the first time) requires the ZeroSSLIssuer type (to generate the EAB credentials when making an ACME account), it's very easy to configure ZeroSSL: Caddy will mostly auto-detect it and wrap the ACMEIssuer properly with ZeroSSLIssuer. You can also explicitly configure ZeroSSL as shown above.

No issuer defaults are changed with this PR.

---

With version 2.3 (to clarify: not 2.2, the release for which this change is slated), we can then work on making one CA a fallback of another. For example, if ZeroSSL is the primary CA but is down, then switch to Let's Encrypt. Or vice-versa, if LE is down (or you've hit rate limits), switch to ZeroSSL.

[mholt]

Sigh -- failing test on s390x VM is unrelated.

Update: We have confirmation from IBM that the connection errors are due to power outages related to Hurricane Isaias.

[francislavoie]

LGTM 👍