ocsp-updater: Split work by a configurable serial suffix shard

[jcjones]

• Enableocsp-updater to query for serials matching a configurable suffix to
  allow for multiple ocsp-updater instances at once
• Add field SerialSuffixShards to OCSPUpdaterConfig
• Add field serialSuffixShards to test/config-next/ocsp-updater.json
• Add codepath to default to the previous query when serialSuffixShards is
  missing from the JSON config

Part of #5629
Fixes #5625

[beautifulentropy]

One small nit.

[beautifulentropy]

A natural evolution for this would be a worker (goroutine) for each configured shards so that we don't have to check for full serial coverage (e.g. do each of these shards make a whole) at the configuration management layer (SaltStack). One drawback of this current implementation is that ocsp_staleness_ages metrics are derived from the tool itself so if the combined instances of the ocsp-updater are missing a narrow shard serials we wouldn't be alerted unless we noticed an overall drop in total updates or alerts on ocsp_response_ages emitted by oscp-responder. Given the critical nature of this change though, I'm fine with shipping it in it's current form.