CA: Add lint/check that SCTs validate before issuing final cert

This idea came out of remediation for https://bugzilla.mozilla.org/show_bug.cgi?id=1838667

Recently we've seen two reasons that the SCTs included in a final cert might not actually validate:

• A GTS incident where they used the SCTs from the wrong precert
• Our incident where the SCT signatures were calculated over different bytes (because the precert didn't match the final cert)

However, we have no lint that checks this. The certificate-transparency-go library checks that the SCTs returned by CT logs actually validate over the precert contents, but we don't have a check that they also validate over the final cert contents.

We should add a lint-like check which confirms this. It will need the CT log public keys in order to successfully validate the SCT signatures. https://github.com/zmap/zlint/issues/728 may handle this for us, in which case this bug should track updating and enabling that lint.

Start by reviewing certificate-transparency-go's SCT validation behavior and the requirements for obtaining CT log public keys. Check whether zlint issue #728 provides the needed lint, then determine how it could be updated and enabled for Boulder. Done means a lint confirms that SCTs in a final certificate validate against that certificate's contents.