Load OCSP test status from certificate database

[sainadh777]

Summary

• load valid and revoked certificate serials from the test CA's index.db
• use the parsed status when building OCSP responses instead of hard-coded serial numbers
• add focused parser coverage and remove completed TODO 82.1

Rationale

The in-process OCSP responder duplicated serial numbers from the certificate
database. Regenerating the test certificates could therefore leave the
responder out of sync with the fixtures. Reading the database at responder
initialization keeps the OCSP status source of truth with the certificates.

This is test infrastructure only. It does not change Tomcat runtime behavior
or public APIs, so no changelog entry is needed.

Validation

Environment: Linux arm64 (eclipse-temurin:21-jdk-jammy), Java 21, Ant
1.10.15.

• ant -Dbase.path=/workspace-cache -Dexecute.validate=true validate
  • Passed with Checkstyle 14.1.0 over 7,687 files.
• ant -Dbase.path=/workspace-cache -Dtest.entry=org.apache.tomcat.util.net.ocsp.TestTesterOcspResponderServlet test
  • Passed: 1 test, 0 failures, 0 errors, 0 skips.
• ant -Dbase.path=/workspace-cache -Dtest.name='**/ocsp/Test*.java' test
  • Passed: 182 tests, 0 failures, 0 errors, 148 skips. The skips are the expected unavailable OpenSSL/Tomcat Native variants; JSSE OCSP paths ran.
• ant -Dbase.path=/workspace-cache clean followed by ant -Dbase.path=/workspace-cache
  • Passed clean source build in 58 seconds.
• ant -Dbase.path=/workspace-cache clean test
  • The first native-volume transfer materialized macOS AppleDouble ._* files, including a false JAR fixture, so that non-clean run was stopped after unrelated manifest-read errors.
  • Retried from a fresh metadata-free Docker-native volume after verifying zero ._* files and SHA-256 matching all changed files.
  • Passed unfiltered suite in 31 minutes 3 seconds: 653 suites, 41,344 tests, 0 failures, 0 errors, 330 skips.
• Generated-distribution runtime smoke
  • Started output/build/bin/catalina.sh run, required HTTP 200 from http://127.0.0.1:8080/ (11,229-byte response), ran shutdown.sh, and verified the server exited with status 0.

The committed versions of all changed files match the SHA-256 hashes of the
files used for the successful Linux validation.

[sainadh777]

@markt-asf, when you have a chance, could you review this test-infrastructure change? You authored all three prior changes to the in-process OCSP responder.