Prefix akamai cache tags to OCSP responses

[jcjones]

This is a follow-on to #5736.

We set the cache tag to a two-character string of the last two hex characters of the serial, without a prefix.

https://github.com/letsencrypt/boulder/blob/7a7f436212bd040a09a5d0ef246f6dc76097d216/cmd/ocsp-responder/main.go#L174-L180

Akamai's cache tag system is unique per-account, so we should optimally configure a prefix to that string so that we can have tags which are for each operational environment. (See the Best Practice "Use cache tag nomenclature" which advises this as well).

[jsha]

Good plan, thanks!

So it seems like the prefix should be a config field, so we can distinguish staging and prod.

[jcjones]

Or it could be the issuer ID.

[jsha]

Ah, that's an awesome idea!