Fixes #8466

…erter (#8494)

Today, timestamp truncation happens for queries using `*borp.DbMap` but
not `*borp.Transaction`. That means comparisons still see sub-seconds,
but inserts into MariaDB `DATETIME` columns silently truncate them to
whole seconds.

On MySQL 8, the same queries will still include sub-seconds, but inserts
into `DATETIME` columns will round to the nearest second instead of
truncate. This leads to issues for queries like the one in
`*StorageAuthority.UpdateCRLShard()`. When two CRL updaters write within
the same second one may be rounded up to the next second. When the other
updater attempts its own `UPDATE .. WHERE thisUpdate <= ?`, the
condition fails because the stored timestamp now appears to be in the
future.

Ahead of the transition from ProxySQL + MariaDB to Vitess + MySQL 8 in
#8468, update borp (letsencrypt/borp#12) to
expose Transaction arguments to the BoulderTypeConverter, allowing it to
truncate all timestamps passed through Transactions and keep behavior
consistent across `*borp.DbMap` and `*borp.Transaction`, as well as
MariaDB and MySQL 8.

Part of #7736

Small comments to keep these three areas of our code in sync. Small fix
to wording; not all of our limits are for a 1 week period.

Add limiter stanza to the SFE's config-next JSON. This should have
happened in [#8359](#8359).

Also, Cleanup our Redis credentials and secrets. These were a little
overly specific, especially now that we've dropped support for OCSP and
thus ROCSP. Instead, rely on a single `boulder` user with the same
permissions that each of the other users had.

If the primary perspective CAA check returns an error, return early
rather than always kicking off the remote checks anyway.

As part of this change, rearrange the code in DoCAA to more closely
mirror the code in DoDCV. In particular, move the creation of the result
protobuf into a helper function which can be called at both the
early-return and late-return locations.

This brings in several new public suffixes under the Bangladesh (.bd)
ccTLD.

Also transitively update various golang.org/x/ packages.

Fixes #8492

…8490)

This started with noticing the semaphore package (forked for use in
OCSP) was dead.

That followed by using the golang `deadcode` tool and Goland's various
"Unused ..." inspection tools to find other dead code.

Nothing in here looks like it would be used externally to Boulder, as
far as I can tell.

Bumps https://github.com/github/codeql-action from v3 to v4.

Context: https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/