Remove fallback code and require SAReadOnlyService once it's in Prod crl-updater/storer configs

Once production has been running with saReadOnlyService set in the crl-storer config and checkFreshness: true in the crl-updater config:

Promote:

• sa/db: move the issuerID_shardIdx_revokedDate_idx index on revokedCertificates from 01-boulder_sa_next.sql into 01-boulder_sa.sql
• test/config: promote from test/config-next the crl-storer saReadOnlyService block, the crl-updater checkFreshness and thisUpdateBackdate settings, and the crl-storer.boulder entry in the SA's sa.StorageAuthorityReadOnly allowlist

Remove:

• cmd/crl-updater/main.go: make the 5-minute thisUpdateBackdate default unconditional
• crl/updater/updater.go: make the freshness check unconditional and remove the freshnessCheck field
• cmd/crl-storer/main.go: make SAReadOnlyService required and drop the conditional client construction
• crl/storer/storer.go: remove the nil check around checkRemovedEntries
• crl/updater/updater_test.go and crl/storer/storer_test.go: delete the freshness-check-disabled and no-read-only-SA test cases

First verify that production has run with saReadOnlyService and checkFreshness enabled. Review the listed SQL migration, test/config and test/config-next entries, then inspect the named Go files and tests for fallback paths and disabled-case coverage. Done means the promoted settings and index are active, fallback code is removed, and the affected updater and storer tests pass.