Deprecate DisableLegacyLimitWrites & UseKvLimitsForNewOrder flags; remove code using certificatesPerName & newOrdersRL tables

[jprenken]

Remove code using certificatesPerName & newOrdersRL tables.

Deprecate DisableLegacyLimitWrites & UseKvLimitsForNewOrder flags.

Remove legacy ratelimit package.

Delete these RA test cases:

• TestAuthzFailedRateLimitingNewOrder (rl: FailedAuthorizationsPerDomainPerAccount)
• TestCheckCertificatesPerNameLimit (rl: CertificatesPerDomain)
• TestCheckExactCertificateLimit (rl: CertificatesPerFQDNSet)
• TestExactPublicSuffixCertLimit (rl: CertificatesPerDomain)

Rate limits in NewOrder are now enforced by the WFE, starting here:

boulder/wfe2/wfe.go

Line 781 in 5a9b4c4

refundLimits, err := wfe.checkNewAccountLimits(ctx, ip)

We collect a batch of transactions to check limits, check them all at once, go through and find which failed, and serve the failure with the Retry-After that's furthest in the future. All this code doesn't really need to be tested again; what needs to be tested is that we're returning the correct failure. That code is NewOrderLimitTransactions, and the ratelimits package's tests cover this.

Add a WFE test for the public suffix handling behavior, specifically, which did not have existing coverage outside the RA.

Some other RA rate limit tests were deleted earlier, in #7869.

Part of #7671.

[github-actions]

@jprenken, this PR appears to contain configuration and/or SQL schema changes. Please ensure that a corresponding deployment ticket has been filed with the new values.

[jprenken]

IN-10906

spam

[aarongable]

Just a few small nits, and one high-level question: can the PR description grow a paragraph describing how the deleted RA test cases are covered by WFE kv-limit test cases?

[jprenken]

Just a few small nits, and one high-level question: can the PR description grow a paragraph describing how the deleted RA test cases are covered by WFE kv-limit test cases?

Addressed and added, thanks! I think there does need to be a replacement for TestExactPublicSuffixCertLimit, which I'll work up and add to this PR.