ocsp-responder: move IssuerID check after Expires check (#5202)
ocsp-responder: move IssuerID check after Expires check (#5202)

It is possible for a CertificateStatus row to have a nil IssuerID
(there was a period of time in which we didn't write IssuerIDs into
CertificateStatus rows at all) but all such rows should be old and
therefore expired.

Unfortunately, this code was checking the IssuerID before it was
checking the Expiry, and therefore was generating panics when trying
to dereference a nil pointer.

This change simply moves the IssuerID check to be after the Expires
check, so that we'll only try to dereference the IssuerID on recent
CertificateStatus rows, where it is guaranteed to be non-nil.

Fixes #5200
letsencrypt/boulder,jsha/boulder,jcjones/boulder,bmw/boulder,bmw/boulder,jsha/boulder,jcjones/boulder,bmw/boulder,letsencrypt/boulder,jcjones/boulder,jsha/boulder,jcjones/boulder,letsencrypt/boulder