[bug] Prevent renewing revoked X.509 certificates

Describe the bug

The certificate renewal endpoint accepts revoked X.509 certificates. Cert.renew() generates a new serial number while leaving revoked=True, so the CA CRL subsequently contains the new serial instead of the serial from the certificate that was revoked. The original certificate can therefore no longer be matched by the current CRL.

Steps To Reproduce

1. Create a CA and a certificate through the PKI API or Django admin.
2. Revoke the certificate with POST /api/v1/controller/cert/<id>/revoke/.
3. Record the revoked certificate serial from the CA CRL.
4. Renew the same certificate with POST /api/v1/controller/cert/<id>/renew/.
5. Download the CA CRL again.

Expected behavior

Renewal of a revoked certificate is rejected, and its original serial remains present in the CA CRL.

Screenshots

N/A.

System Information:

• OS: Linux
• Python Version: 3.10.19
• Django Version: 5.2.15
• Browser and Browser Version: N/A

The issue reproduces from the current master implementation of CertRenewView.post(). A regression test should revoke a certificate, attempt renewal, and assert that the request is rejected and that the original revoked serial remains in the CRL.