cert-checker: avoid accidentally mis-ordered certs (#5561)
cert-checker: avoid accidentally mis-ordered certs (#5561)

It's possible for an AUTO_INCREMENT database field (such as the ID
field on the Certificates table) to not actually be monotonically
increasing. As such, it is possible for cert-checker to get into a
state where it correctly queries for the number of certs it has to
process and the minimum ID from among those certs, but then actually
retrieves much older certs when querying for them just by ID.

Update cert-checker's query to predicate on id, expiry, and issuance
time, to avoid checking certs which were issued a significant time in
the past.

Part of #5541
jcjones/boulder,jcjones/boulder,jsha/boulder,jcjones/boulder,letsencrypt/boulder,jsha/boulder,letsencrypt/boulder,jsha/boulder,letsencrypt/boulder,jcjones/boulder