Add the dns-persist-01 ACME challenge type

[joshdrake]

Name of feature:

ACME dns-persist-01 challenge type
(draft-ietf-acme-dns-persist-02).

Changes to ACMEProvisioner in spec/linkedca/provisioners.proto:

• A new ChallengeType value, DNS_PERSIST_01 = 5.
• string account_hash_prefix = 9: the URL prefix of the hashed account URIs that clients publish in their
  _validation-persist TXT records.
• repeated string issuer_domain_names = 10: the issuer domain names those records may name.

These match the accountHashPrefix and issuerDomainNames properties of the step-ca ACME provisioner.

A separate commit bumps the indirect golang.org/x/net dependency from v0.58.0 to v0.61.0. That fixes GO-2026-6603,
GO-2026-6611, GO-2026-6612 and GO-2026-6617, which were failing govulncheck on main as well. It also pulls in newer
indirect golang.org/x modules.

provisioners.pb.go was regenerated with make generate. Its header records a newer local protoc (v7.36.1).
The other generated files were left unchanged, so the diff only covers this change.

Pain or issue this feature alleviates:

step-ca converts provisioners to and from linkedca in two places:

• Remote provisioner management.
• step ca provisioner add/update, which convert ca.json provisioners to linkedca and back.

Without this change, both conversions silently drop dns-persist-01 and its options. If dns-persist-01 was the
only challenge configured, the provisioner falls back to the default http-01, dns-01 and tls-alpn-01 challenges.

Is there documentation on how to use this feature? If so, where?

Not yet. The step-ca documentation will cover it with the step-ca change.

Supporting links/other PRs/issues:

• Add the ACME dns-persist-01 challenge certificates#2826 adds the challenge to step-ca and maps these fields.
• Add dns-persist-01 to the ACME provisioner commands cli#1721 adds the provisioner flags.
• ACME: Add support for DNS-PERSIST-01 certificates#2697

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[maraino]

lgtm