wip: revocation: Optionally require nonces in OCSP responses

wip: revocation: Optionally require nonces in OCSP responses

To prevent potential replay attacks it might be preferable to actually
require that nonces are contained in OCSP responses.  Otherwise, if the
OCSP server replies to requests with and without nonces, and depending on
the lifetime of the responses, attackers could send cached responses they
requested without nonce as reply to our requests with nonces.

wip: As mentioned above, this is only a problem if servers reply to requests
with and without nonce. So if this is a concern, it might be an option to
configure the server to not reply to requests that don't contain a nonce (if
possible, the OpenSSL OCSP server does not seem to have an option to do so).