Validate OCSP ProducedAt

When receiving an OCSP response, AMP Packager should validate that its ProducedAt is within the NotBefore/NotAfter of the cert. I think the place to do that is [here](https://github.com/ampproject/amppackager/blob/f36311a1de3c0437debf0f6d1c3a0bf6666c7a0a/packager/certcache/certcache.go#L636-L659). (It looks like the `ocsp.ParseResponseForCert` function doesn't do this already.)

Start in packager/certcache/certcache.go at lines 636-659 and trace the OCSP response handling around ocsp.ParseResponseForCert. Confirm that ProducedAt is checked against the certificate's NotBefore and NotAfter values; the work is done when responses outside that validity window are rejected.

Written by the indexing model from the issue text.