Use fresh account state for ACME auth

[akshithg]

Closes #8795.
Refs #6144.

Use current read-only SA account state when authenticating account-keyed ACME requests that can mutate account, authorization, challenge, order, revocation, or issuance state. This keeps the WFE-local account cache for cacheable account lookups, but avoids relying on cached account status or cached account keys before authorization-sensitive operations.

The fresh path still uses WFE2's existing StorageAuthorityReadOnlyClient; it only bypasses the WFE-local account cache. It does not add direct primary database access from WFE2.

Also purge this WFE's local cached account entry after successful account update/deactivation and key rollover. That purge improves same-WFE freshness, while the authorization boundary is the fresh read-only SA lookup on mutation and issuance paths.

Tests:

• go test -mod=vendor ./wfe2 -run '^(TestCache|TestWrongId|TestErrorPassthrough|TestValidPOSTForCurrentAccountRejectsCached(DeactivatedAccount|PreRolloverKey))' -count=1 -v
• go test -mod=vendor ./wfe2 -run '^$' -count=1

[jsha]

Looks like the CI failures are probably legit:

    key_rollover_test.go:45: rolling over account key: acme: error code 400 "urn:ietf:params:acme:error:malformed": Unable to validate JWS :: JWS signature header algorithm "ES256" does not match expected algorithm "RS256" for JWK

[akshithg]

@jsha fixed in 29fac42