Add AlreadyRevoked handling to revokedCertificates table inserts

sa/db-next/boulder_sa/20251021000000_AddRevokedSerialsIndex.sql

@@ -0,0 +1,12 @@
+-- +migrate Up
+-- SQL in section 'Up' is executed when this migration is applied
+
+ALTER TABLE `revokedCertificates` REMOVE PARTITIONING;
+ALTER TABLE `revokedCertificates` ADD UNIQUE INDEX `serial` (`serial`);
+
+-- +migrate Down
+-- SQL section 'Down' is executed when this migration is rolled back
+
+ALTER TABLE `revokedCertificates` DROP UNIQUE INDEX `serial`;
+ALTER TABLE `revokedCertificates` PARTITION BY RANGE(id)
+(PARTITION p_start VALUES LESS THAN (MAXVALUE));

sa/sa.go

@@ -806,6 +806,12 @@ func addRevokedCertificate(ctx context.Context, tx db.Executor, req *sapb.Revoke
 		NotAfterHour: serial.Expires.Add(time.Hour).Truncate(time.Hour),
 	})
 	if err != nil {
+		if db.IsDuplicate(err) {
+			// An attempted duplicate insert means that this certificate was already
+			// revoked. The RA has special logic for that case, so use the specific
+			// error for it.
+			return berrors.AlreadyRevokedError("certificate already revoked")
+		}
 		return fmt.Errorf("inserting revoked certificate row: %w", err)
 	}