go1.22: Prepare for RSA Key Exchange removal by default

[mcpherrinm]

In Go 1.22, the cipher suites using RSA kex are disabled in clients by default.
This may affect outgoing validation requests for TLS-ALPN-01 and HTTP-01 (with https redirects).

We likely want a way to measure how many RSA key exchanges we're doing to decide how long a deprecation period we want.

We can re-enable them in crypto/tls#Config.CipherSuites. If that's not feasible for some reason, we can also use the GODEBUG tlsrsakex=1 variable, though it would be better to have that in Boulder's own code I think.

[aarongable]

As discussed in standup, better approach than the above:

1. Do it in logs (e.g. add a "usedRSAKEX" field to va.go's validationRequestEvent)
2. For http-01, get the tls ConnectionState from the http.Response object, rather than using the verify func

Difficulty: there's no easy way to exfiltrate extra metadata from the individual verify functions up to the top level of the VA where the logEvent lives.

[aarongable]

This work is complete and we have the relevant (moderate in absolute terms, minuscule in relative terms) numbers. The plan from here is to set the tlsrsakex=1 env var, upgrade to go1.22.1, announce the deprecation of RSA KEX, wait a few weeks, and then remove the env var.