Dynamically generate grpc-creds at integration test startup

[aarongable]

The summary here is:

• Move test/cert-ceremonies to test/certs
• Move .hierarchy (generated by the above) to test/certs/webpki
• Remove our mapping of .hierarchy to /hierarchy inside docker
• Move test/grpc-creds to test/certs/ipki
• Unify the generation of both test/certs/webpki and test/certs/ipki into a single script at test/certs/generate.sh
• Make that script the entrypoint of a new docker compose service
• Have t.sh and tn.sh invoke that service to ensure keys and certs are created before tests run

No production changes are necessary, the config changes here are just for testing purposes.

Part of #7476

[aarongable]

The unit tests pass, huzzah! Now I just need to figure out why the integration tests start, but the WFE believes it has no gRPC backends to talk to...

[pgporada]

The WFE does have backends, but helpers.py needs to be changed to fix some OCSP verification checks.

Traceback (most recent call last):
  File "test/integration-test.py", line 146, in <module>
    main()
  File "test/integration-test.py", line 83, in main
    setup_twenty_days_ago()
  File "/boulder/test/helpers.py", line 170, in setup_twenty_days_ago
    f()
  File "/boulder/test/v2_integration.py", line 1696, in ocsp_resigning_setup
    ocsp_response, reason = get_ocsp_response_and_reason(
  File "/boulder/test/v2_integration.py", line 1673, in get_ocsp_response_and_reason
    output = verify_ocsp(cert_file, issuer_glob, url, None)
  File "/boulder/test/helpers.py", line 111, in verify_ocsp
    raise(lastException)
  File "/boulder/test/helpers.py", line 106, in verify_ocsp
    output = try_verify_ocsp(cert_file, issuer_file, url, status, reason)
  File "/boulder/test/helpers.py", line 126, in try_verify_ocsp
    verify_output = ocsp_verify(cert_file, issuer_file, resp)
  File "/boulder/test/helpers.py", line 84, in ocsp_verify
    output = subprocess.check_output([
  File "/usr/lib/python3.8/subprocess.py", line 415, in check_output
    return run(*popenargs, stdout=PIPE, timeout=timeout, check=True,
  File "/usr/lib/python3.8/subprocess.py", line 516, in run
    raise CalledProcessError(retcode, process.args,
subprocess.CalledProcessError: Command '['openssl', 'ocsp', '-no_nonce', '-issuer', 'test/certs/webpki/int-rsa-a.cert.pem', '-cert', '/tmp/tmpizzvdzrw/tmpeg6wmwjs.ocsp_resigning_setup.pem', '-verify_other', 'test/certs/webpki/int-rsa-a.cert.pem', '-CAfile', '/hierarchy/root-rsa.cert.pem', '-respin', '/tmp/tmpizzvdzrw/tmpmm9tej9u']' returned non-zero exit status 1.

The fix to apply is

diff --git a/test/helpers.py b/test/helpers.py
index b0ad43146..3a7e38615 100644
--- a/test/helpers.py
+++ b/test/helpers.py
@@ -86,7 +86,7 @@ def ocsp_verify(cert_file, issuer_file, ocsp_response):
             '-issuer', issuer_file,
             '-cert', cert_file,
             '-verify_other', issuer_file,
-            '-CAfile', '/hierarchy/root-rsa.cert.pem',
+            '-CAfile', 'test/certs/webpki/root-rsa.cert.pem',

When that's done you'll progress to other cert path issues like

--- FAIL: TestAkamaiPurgerDrainQueueFails (0.00s)
    akamai_purger_drain_queue_test.go:76: reading CA cert from "test/grpc-creds/minica.pem": open test/grpc-creds/minica.pem: no such file or directory
--- FAIL: TestAkamaiPurgerDrainQueueSucceeds (0.00s)
    akamai_purger_drain_queue_test.go:108: reading CA cert from "test/grpc-creds/minica.pem": open test/grpc-creds/minica.pem: no such file or directory
FAIL
FAIL    github.com/letsencrypt/boulder/test/integration 28.859s
FAIL
Traceback (most recent call last):
  File "test/integration-test.py", line 146, in <module>
    main()
  File "test/integration-test.py", line 93, in main
    run_go_tests(args.test_case_filter)
  File "test/integration-test.py", line 47, in run_go_tests
    subprocess.check_call(cmdLine, stderr=subprocess.STDOUT)
  File "/usr/lib/python3.8/subprocess.py", line 364, in check_call
    raise CalledProcessError(retcode, cmd)

Hope that helps 👋🏼

[github-actions]

@aarongable, this PR appears to contain configuration and/or SQL schema changes. Please ensure that a corresponding deployment ticket has been filed with the new values.

[pgporada]

Looks good. I have a few minor things. Feel free to ignore them.