This commit implements the proposed replacement of proactive issuance
and the "CSR first" new-order flow proposed on the ACME mailing list[0].

Mentions of proactive issuance are removed. The CSR field of the order
object is removed. A new "finalizeURL" field is added to the order
object. A new "identifiers" field is added to the order object. Issuance
process is updated to describe submitting identifiers in the new-order
request and POSTing a CSR to the order's finalizeURL.

[0] https://mailarchive.ietf.org/arch/msg/acme/DIjJEB06J5cFyuOlGPVcY2I51vg

This commit:
* updates the Action,Request,Response table for the
  finalization process.
* updates the example order object with a certificate URL to be status
  "valid" (since a cert has been issued)
* clarifies the finalization language w.r.t errors
* updates the registry of order fields to capture the finalizeURL

The spec should be more precise about the fact that a wildcard
identifier is specific to DNS type identifiers and must follow the
conventions of the web PKI w.r.t number & placement of wildcard
characters.

This commit incorporates feedback from @jsha (thanks!) refining the
wildcard identifier value clarification.