CRL ceremony: take previous CRL as input

[aarongable]

The CRL ceremony type should take a previously-published CRL as one of its inputs. It can then check:

• that the configured CRL number is greater than the previous number
• that the configured list of revoked certs isn't missing any that were present in the previous CRL, and that weren't already expired at the time of that previous CRL
• that the Issuer and Issuing Distribution Point (if present) is/are identical