feat: short-lived certs always pass OCSP checks

[Seirdy]

Firefox skips OCSP checks for certs younger than the number of days specified in security.pki.cert_short_lifetime_in_days (10 by default), which makes sense because OCSP stapling is redundant for short-lived certs. Revocation is only applicable to long-lived certs with lifetimes measured in weeks or longer.

Ready now exhibits the same behavior.