Generate etag/last-modified for cert-urls

The etag should be a digest of the entire cert-chain including OCSP response. Additionally, we may want to handle incoming conditional headers and return 304 as appropriate.

Start by tracing how cert-urls responses are generated and inspect the existing certificate-chain and OCSP response handling. Confirm the expected digest inputs and whether conditional request headers are supported; done means the response metadata reflects the full chain and OCSP response, with 304 behavior defined and tested.

Written by the indexing model from the issue text.