Refactor cert approval check to account for existing cert

[tj]

Currently if Up is waiting on a cert approval, and you C^, the next run will not output Check your email to approve the certificate, resulting in a up stack apply` attempting to use an unapproved certificate for the domain.

createCerts() uses some local state from RequestCertificate to see if we're waiting or not, it should just check pending certs instead to allow for both scenarios