ACME: post a challenge once, then poll the authorization

The renewal loop re-posted the challenge every time it polled and found the
authorization still pending. RFC 8555 section 7.5.1 has the client post a
challenge once to say it is ready and then poll; a server that has already
moved the challenge to "processing" refuses a second post, and pebble
answers 400 malformed, which failed the whole renewal.

Verified against pebble: the 400s are gone and the client polls. The suite
still can't finish on this machine, because pebble never reaches the test
server to validate the challenge; that path is the environment, and the
runbook now says so.

crates/common/src/network/acme/order.rs

@@ -234,7 +234,7 @@ impl AcmeRequestBuilder {
         let mut retry_after = response.retry_after;
         let auth = response.body;
 
-        let (domain, challenge_url) = match auth.status {
+        let domain = match auth.status {
             AuthStatus::Pending => {
                 let Identifier::Dns(domain) = auth.identifier;
 
@@ -318,7 +318,7 @@ impl AcmeRequestBuilder {
                 }
 
                 self.challenge(&challenge.url).await?;
-                (domain, challenge.url.clone())
+                domain
             }
             AuthStatus::Valid => return Ok(()),
             _ => {
@@ -345,14 +345,20 @@ impl AcmeRequestBuilder {
 
             match response.body.status {
                 AuthStatus::Pending => {
+                    // inbuxa: keep polling, don't post the challenge again.
+                    // RFC 8555 section 7.5.1 has the client post a challenge
+                    // once to say it's ready and then poll the authorization,
+                    // which stays pending while validation runs. Posting it
+                    // again is refused once the server has moved the
+                    // challenge to "processing" (pebble answers 400
+                    // malformed, "Cannot update challenge with status
+                    // processing"), and that refusal failed the renewal.
                     trc::event!(
                         Acme(AcmeEvent::AuthPending),
                         Hostname = domain.to_string(),
                         Url = self.directory.new_order.to_string(),
                         Total = i,
                     );
-
-                    self.challenge(&challenge_url).await?
                 }
                 AuthStatus::Valid => {
                     trc::event!(