Support signing over OCSP responses

WICG/webpackage#121 will change the SXG signed message to include the OCSP response attached to the cert-chain+cbor. This means that:

1. Every ~3.5 days, the cert-url will change, to reflect the different OCSP response attached. (Or else old SXGs won't validate any more.)
2. When signing a document, the packager must request the freshest cert-url from the certcache.

Start by reading the linked WICG/webpackage#121 change and tracing the packager's document-signing flow and certcache handling. Confirm where the freshest cert-url is obtained and how the OCSP response is included, then verify that newly signed SXGs continue to validate as the response changes.

Written by the indexing model from the issue text.