Persist the ACME account key: dns01_txt mode creates a new Let's Encrypt account per certificate

[Hoeze]

createLegoClient (externalcas/external.go:96) generates a fresh account key on every call, and nothing persists it. In dns01_txt mode, external.go:148 then does a plain Registration.Register, so every certificate issued through Let's Encrypt creates a new ACME account.

This has two consequences:

1. Rate limits. Let's Encrypt allows only 10 new accounts per IP per 3 hours.
2. Revocation should fail. RevokeCertificate also builds a fresh client, so it signs with an account that never issued the certificate. RFC 8555 section 7.6 does not allow that.

This issue could be solved by adding an optional account_key_path under authority.config that gets loaded/generated on startup.
This way, registration would be idempotent, because newAccount with a known key returns the existing account (RFC 8555 section 7.3).