Switch nag group to count serials, not certs (#5605)
Switch nag group to count serials, not certs (#5605)

If expiry mailer's SELECT statement is regularly returning exactly
as many rows as it is configured to limit at, that means that we are
consistently missing some certs that we should probably be sending
emails about. Change the way this metric is computed to be based
on the number of rows returned directly by the SELECT, rather than
based on the filtered set of rows that ended up corresponding to
final certificates.

This bug was almost certainly causing us to not detect nag groups
being at capacity, given that the expiry-mailer logs consistently say
that nag groups have nearly-but-not-quite as many certs in them as
the configured maximum. This bug was introduced in #4420, when
expiration-mailer gained the ability to silently continue past certain
classes of errors retrieving certificate details.
letsencrypt/boulder,jcjones/boulder,jcjones/boulder,jcjones/boulder,jsha/boulder,letsencrypt/boulder,jsha/boulder,letsencrypt/boulder,jsha/boulder,jcjones/boulder