ACME: Add support for DNS-PERSIST-01

Hello!

• Vote on this issue by adding a reaction
• If you want to implement this feature, comment to let us know (we'll work with you on design, scheduling, etc.)

Issue details

Per official documentation, step-ca supports multiple ACME verification methods to prove ownership of a device or domain. I suggest adding support for the new dns-persist-01. While the standard is still in it's draft state, Let's Encrypt is adding support with CA/Browser Forum engagement.

Why is this needed?

One of the go-to methods in more controlled environments is using "dns-01", to remove a need of a plain-HTTP endpoint on every requesting service and allows for lack of such egress from step-ca to other parts of the network. However, its biggest downside is the need for API-driven DNS record management. To put it plain and simple, most providers either don't provide that or force a very unsafe and often unacceptable tradeoffs (e.g. no ACLs on API keys). It often necessitates deployment of substandard solutions like acme-dns.

The "dns-persist-01" solves shortcoming of the prior DNS verification, making it not only set-once, but also including scoping metadata. It also makes auditing the DNS much easier, and resolves headaches related to propagation.