Retry without replaces-field when appropriate

[oliverpool]

Fixes caddyserver/certmagic#361

This is more of a workaround, but apparently the spec expects the server to reject orders when a certificate has already been replaced. So the client should retry: ietf-wg-acme/acme-ari#56 (comment) (via caddyserver/certmagic#364 (comment))

[mholt]

I like this approach much better. Does it work for you?

[oliverpool]

I did not test it. To unblock my situation, I disabled ARI for now (so I have a valid certificate and cannot reproduce the issue).

Ideally I can add a unittest to this PR. I saw that https://github.com/letsencrypt/pebble is made for this.
Unfortunately it does not implement alreadyReplaced properly yet... I am looking into implementing it there.

[oliverpool]

I added a test.
This is currently failing until letsencrypt/pebble#532 is merged (and go.mod updated).

To test locally, clone my fork and use the replace directive in go.mod:

replace github.com/letsencrypt/pebble/v2 => /path/to/your/clone/with/my/pr

[oliverpool]

@mholt the pebble PR has been merged and I updated the dependencies accordingly (the change is not included in a tagged pebble release yet).

So running the tests on 189769b fails, but they succeed with ae28ddd

[mholt]

Thanks!! Sorry for the delay on this, life's been crazy. Will circle back soon

[mholt]

Thanks for this, @oliverpool -- sorry for my absurdly long response time.

Let's give it a try!

[oliverpool]

No need to apologize, hope life is a bit less crazy now.

Thank you for all the efforts you invest in the https/acme/go ecosystem!