Add role-based health checks to PKI Health Check

[cipherboy]

Based on #17750 and #17865; will be rebased once they merge.

This adds the three role-based health checks:

• role_allows_localhost, for whether or not a role has both a non-empty allowed_domains list and allow_localhost=true.
• role_allows_glob_wildcards, for whether or not a role allows both glob domains and wildcard certs, which is potentially unsafe.
• role_no_store_false, for whether or not a role has roles with no_store=false and no auto-rebuild of CRLs, as this can cause performance issues.

[cipherboy]

Will be rebased once #17984 is merged. #17984 no longer has invasive changes so this should be stand-alone now, though semgrep will fail with the two findings #17984 will fix, I've added fixes for the remainder in-tree.

[stevendpclark]

Overall +1, just a few nits and a question or two to validate my understanding.

[stevendpclark]

lgtm, thanks for the tweaks.

[cipherboy]

Thanks! Merging...