OCSPrefresh multiple CA's

I have configured mutliroot ca with two different intermidiate CA's which both use the same db.conf and hence the same database e.g.

```
[Wikimedia_SRE_Internal]
private = file:///etc/cfssl/signers/Wikimedia_SRE_Internal/ca/Wikimedia_SRE_Internal-key.pem
certificate = /etc/cfssl/signers/Wikimedia_SRE_Internal/ca/Wikimedia_SRE_Internal.pem
config = /etc/cfssl/signers/Wikimedia_SRE_Internal/cfssl.conf
dbconfig = /etc/cfssl/db.conf

[Wikimedia_testing_CA]
private = file:///etc/cfssl/ssl/Wikimedia_testing_CA/Wikimedia_testing_CA-key.pem
certificate = /etc/cfssl/ssl/Wikimedia_testing_CA/Wikimedia_testing_CA.pem
config = /etc/cfssl/signers/Wikimedia_testing_CA/cfssl.conf
dbconfig = /etc/cfssl/db.conf
```

This seems to work well and i can issue and revoke certs in both CA's without issue. however when i attempt to configure OCSP using ocsprefresh i get the following error

```
$ sudo /usr/bin/cfssl ocsprefresh \
-db-config /etc/cfssl/db.conf \
-responder /etc/cfssl/ssl/ocsp/OCSP_Wikimedia_SRE_Internal_ocsp_discovery_wmnet.pem \
-responder-key /etc/cfssl/ssl/ocsp/OCSP_Wikimedia_SRE_Internal_ocsp_discovery_wmnet-key.pem \
-ca /etc/cfssl/signers/Wikimedia_SRE_Internal/ca/Wikimedia_SRE_Internal.pem -loglevel=0
2020/11/30 18:24:45 [DEBUG] Loading issuer cert: /etc/cfssl/signers/Wikimedia_SRE_Internal/ca/Wikimedia_SRE_Internal.pem
2020/11/30 18:24:45 [DEBUG] Loading responder cert: /etc/cfssl/ssl/ocsp/OCSP_Wikimedia_SRE_Internal_ocsp_discovery_wmnet.pem
2020/11/30 18:24:45 [DEBUG] Loading responder key: /etc/cfssl/ssl/ocsp/OCSP_Wikimedia_SRE_Internal_ocsp_discovery_wmnet-key.pem
2020/11/30 18:24:45 [DEBUG] loading db configuration file from /etc/cfssl/db.conf
2020/11/30 18:24:45 [CRITICAL] Unable to sign OCSP response: {"code":8100,"message":"Certificate not issued by this issuer"}
{"code":8100,"message":"Certificate not issued by this issuer"}
```

The responder certificate used above is signed by the ca file specificed in the same command

```
pki2001 ~ % sudo openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_Wikimedia_SRE_Internal_ocsp_discovery_wmnet.pem -noout -text | grep -A1 'Authority Key Identifie'
X509v3 Authority Key Identifier:
keyid:AC:BB:B1:6B:ED:27:83:D7:87:93:8C:97:17:51:C5:BB:8A:EA:95:D2
pki2001 ~ % sudo openssl x509 -in /etc/cfssl/signers/Wikimedia_SRE_Internal/ca/Wikimedia_SRE_Internal.pem -noout -text | grep -A1 'Subject Key Identifie'
X509v3 Subject Key Identifier:
AC:BB:B1:6B:ED:27:83:D7:87:93:8C:97:17:51:C5:BB:8A:EA:95:D2
```

However i suspect that the ocsp refresh fails because it asks certdb for [all unexpired certificates](https://github.com/cloudflare/cfssl/blob/master/certdb/sql/database_accessor.go#L31-L33) and there are indeed some certificate signed with the other CA specified by multi root.

It seems to me that certdb is intended to support multiple CA's as it has an AKI field. As such would it be possible to update ocsprefresh to parse the CA cerrtificate passed via `-ca` and use the ski as a contrsint in the select statment

i.e.

```
selectAllUnexpiredSQL = `
SELECT %s FROM certificates
WHERE (CURRENT_TIMESTAMP < expiry AND authority_key_identifier = ?) ;
```