Log DNSSEC status for CAA queries

[rolandshoemaker]

Simplest solution is just to check if the resolver set the AD bit in the response in our LookupCAA function.

[cpu]

@rolandshoemaker was this resolved by https://github.com/letsencrypt/boulder/pull/2716 ?

[rolandshoemaker]

This is related to the Present: xxx, Valid for issuance: xxx logging code in the VA.

[aarongable]

The metric set in https://github.com/letsencrypt/boulder/pull/2716 no longer exists, so we're no longer collecting this data, let alone logging it. This data is particularly of interest again as we work with the Princeton CITP on investigating the benefits of DNSSEC on the WebPKI.