CA: Add lint/check that SCTs validate before issuing final cert

[aarongable]

This idea came out of remediation for https://bugzilla.mozilla.org/show_bug.cgi?id=1838667

Recently we've seen two reasons that the SCTs included in a final cert might not actually validate:

• A GTS incident where they used the SCTs from the wrong precert
• Our incident where the SCT signatures were calculated over different bytes (because the precert didn't match the final cert)

However, we have no lint that checks this. The certificate-transparency-go library checks that the SCTs returned by CT logs actually validate over the precert contents, but we don't have a check that they also validate over the final cert contents.

We should add a lint-like check which confirms this. It will need the CT log public keys in order to successfully validate the SCT signatures. zmap/zlint#728 may handle this for us, in which case this bug should track updating and enabling that lint.