Implement Retry-After, and refactor authorization polling (#6766)

Fixes #5789

This PR is about allowing Certbot to respect the Retry-After HTTP header that an ACME CA server can return to a client POSTing to a challenge, to instruct him and retry the request later.

However, this feature was not easily implementable in the current code of certbot.auth_handler, because the code became really hard to read. In fact, @bmw was thinking that the code was really deceiving, and a lot of supposed functionalities declared in the comments were in fact not implemented or not functional.

So I took the time to understand what was going on, and effectively, most of the code is in fact not usable or not used. Then I did a refactoring against the bare ACME spec about what to do to prepare challenges, instruct the ACME CA server to perform them, then polling regularly the authorization resources until they are decided (valid or invalid).

And of course this implementation takes care of Retry-After ^^

I added a lot of comments in the new implementation, to explain what is going on for a future developer. The workflow I used is relying on the relationships between authorizations and challenges states as described in section 7.1.6 of the ACME spec draft: https://datatracker.ietf.org/doc/draft-ietf-acme-acme/

* Clean auth_handler a bit, and implement retry-after.

* Remove a debug logger

* Correct tests

* Fix mypy and lint. Setup max retries and default retry after accordingly.

* Ease a comparison in tests

* Update documentation

* Add tests

* Adapt windows coverage threshold to the global LOC reduction

* Update certbot/auth_handler.py

Co-Authored-By: adferrand <adferrand@users.noreply.github.com>

* Corrections under review

* Correction under review

* Update certbot/auth_handler.py

Co-Authored-By: adferrand <adferrand@users.noreply.github.com>

* Corrections under review

* Update auth_handler_test.py

* Reimplementing user readable report for failed authorizations

* Fixes two tests

* Fix another test + lint + mypy

* Update auth_handler.py

* Update auth_handler_test.py

* Fix tests

* Update certbot/auth_handler.py

Co-Authored-By: adferrand <adferrand@users.noreply.github.com>

* Raise directly the exception on polling timout

* Improve interface documentation

* Move the wait on top of the loop, to be used initially or after a new loop iteration. Do not wait for negative values.

* Always display the report about failed authorizations.

* Clarify an exception.

* Return, instead of break

* Use setdefault

* Remove useless assertion

* Adapt tests

* Improve a test about retry after value.

* Update certbot/auth_handler.py

Co-Authored-By: adferrand <adferrand@users.noreply.github.com>

* Add a complete test on best_effort

* Add entry to the changelog

* Gather all failed authzrs to be reported in one unique report in case of best_effort

* Build complete warn/report/raise process about failed authzrs

1 files changed, 1 insertions, 1 deletions

diff --git a/tox.cover.py b/tox.cover.py
index e323ba255..d0f97626a 100755
--- a/tox.cover.py
+++ b/tox.cover.py
@@ -12,7 +12,7 @@ DEFAULT_PACKAGES = [
     'certbot_dns_sakuracloud', 'certbot_nginx', 'certbot_postfix', 'letshelp_certbot']
 
 COVER_THRESHOLDS = {
-    'certbot': {'linux': 98, 'windows': 94},
+    'certbot': {'linux': 98, 'windows': 93},
     'acme': {'linux': 100, 'windows': 99},
     'certbot_apache': {'linux': 100, 'windows': 100},
     'certbot_dns_cloudflare': {'linux': 98, 'windows': 98},