va: normalize caa parameter tags to lowercase

[1seal]

fixes #8614.

this normalizes caa parameter tag names to lowercase during parsing, so mixed-case forms like AccountURI= and ValidationMethods= are enforced the same way as the lowercase forms.

adds regression coverage in va/caa_test.go for mixed-case accounturi and validationmethods (including issuewild).

[1seal]

two questions:

1. should this change be treated as security-relevant (ghsa and/or release note)? the prior behavior (mixed-case accounturi/validationmethods being silently treated as absent) could allow issuance that domain operators intended to restrict.

2. do you prefer confirmation from cabf/acme folks on the case-insensitive parameter-tag interpretation before merge, or is the rfc 8659 analogy (property tags are case-insensitive) sufficient?

[aarongable]

1. should this change be treated as security-relevant (ghsa and/or release note)? the prior behavior (mixed-case accounturi/validationmethods being silently treated as absent) could allow issuance that domain operators intended to restrict.

No, this does not rise to the level of something warranting notice, this has not affected anyone, and site operators are not generally aware of the Boulder source repository and release process.

2. do you prefer confirmation from cabf/acme folks on the case-insensitive parameter-tag interpretation before merge, or is the rfc 8659 analogy (property tags are case-insensitive) sufficient?

See my comment on the initial bug; we'd actually like to take this a different direction.

[1seal]

pushed an update implementing the "fail-closed" direction:

• removed the lowercase-normalization behavior
• if an applicable record (issuer-domain matches) contains mis-capitalized AccountURI/ValidationMethods tags, we now deny issuance and return a message telling the applicant which lowercase tag to use
• added a DoCAA-level test to assert the error detail is helpful

commit: e125976