x/crypto/acme: invalid Retry-After values can stop retries or cause tight polling

The x/crypto/acme package does not safely handle malformed or expired Retry-After header values.

A negative delay-seconds value such as:

Retry-After: -1

is accepted by strconv.Atoi and converted to a negative duration. In the default retry path, adding the existing jitter still produces a non-positive duration, causing the retry loop to stop with "no more retries".

An expired HTTP-date can also produce a negative duration. WaitOrder and WaitAuthorization only check for d == 0, so a negative duration is passed to time.NewTimer and causes immediate polling, potentially resulting in a tight request loop.

The default backoff path also indexes the header value directly. A response containing:

http.Header{"Retry-After": nil}

can therefore panic.

Expected behavior:

- reject negative and overflowing delay-seconds values;
- ignore malformed and expired Retry-After values;
- fall back to the default backoff when the value is unusable;
- avoid indexing a possibly empty header slice.

Start by reading Retry-After parsing and the default backoff path in x/crypto/acme, then trace the retry behavior in WaitOrder and WaitAuthorization. Exercise the package's existing tests or add focused cases for negative, overflowing, malformed, expired, and empty header values. Done means unusable values fall back safely without stopping retries, tight polling, or panics.

Written by the indexing model from the issue text.