staple only when OCSP response status is "good"

[ElvinEfendi]

What this PR does / why we need it:

Rel #5397

I have not found any spec for what to do in the server when OCSP response validation fails - let me know if you have a thought!

In the meantime in this PR I'm switching to what vanilla Nginx does - staple iff response status is "good" and response passes other checks in https://github.com/openresty/lua-nginx-module/blob/896638287afd83f060d3f8e9a51b53dbd26d0ae7/src/ngx_http_lua_ssl_ocsp.c#L263.

I think in the world where OCSP must-staple is no prevalent it makes more sense to avoid stapling when OCSP response is invalid. However I still don't get why Nginx considers OCSP response with status "revoked" as invalid.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Which issue/s this PR fixes

How Has This Been Tested?

Checklist:

• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I've read the CONTRIBUTION guide
• I have added tests to cover my changes.
• All new and existing tests passed.

[aledbf]

/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: aledbf, ElvinEfendi

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [ElvinEfendi,aledbf]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[aledbf]

/retest