mtca: Serve checkpoints after sequencing and signing

[beautifulentropy]

• mtca: Serve the checkpoint at the end of each sequencing pass and after InitLog
• mtca: Serve the latest checkpoint in Preflight, covering a process that stopped between publishing tiles and serving
• mtca: Build and verify the checkpoint when signing it, and serve that same checkpoint
• mtca: Write the checkpoint with If-Match on the last ETag, or If-None-Match: * before the first write, and return ErrCheckpointChanged on 412 or 404
• mtca: On ErrCheckpointChanged, adopt the served checkpoint's ETag only if it verifies against the MTCA's key with a tree no larger than ours, otherwise refuse to replace it
• mtca: Refuse to initialize a log whose checkpoint is already served
• trees/cosignature: Inline VerifyCheckpoint into Verify
• bs3/bs3test: Track ETags, enforce If-Match and If-None-Match with 412, and return 404 for a missing key
• test/integration: Ensure the mtca and sunlight checkpoints concur

Closes #9004

[github-actions]

@beautifulentropy, this PR appears to contain configuration and/or SQL schema changes. Please ensure that a corresponding deployment ticket has been filed with the new values.

[aarongable]

LGTM with nits, modulo upstream PR being updated for tests to pass.

[jsha]

Could you fill out the PR description? Also, a PR naming nit: CQRP refers to "Chrome's Landmark Service", not "CQRP Landmark Service." But I think it would be simplest to say "mtca: serve checkpoints with 2 cosignatures," and mention in the description that this is a requirement of the CQRP.

https://googlechrome.github.io/chromerootprogram/cqrp/draft-policy/