handle Let's Encrypt removing OCSP support

We can no longer use OCSP stapling and Must-Staple. These will soon be
obsolete once the `shortlived` profile is available for public use since
it will provide certificates with a similar lifetime as OCSP responses.

In the meantime, we've moved to the `tlsserver` profile stripping legacy
features to prepare for the `shortlived` profile which will be identical
to `tlsserver` but with a validity period of 6 days.

static/features.html

@@ -1489,7 +1489,6 @@
                     when sending mail including alert messages from the attestation service</li>
                     <li>SSHFP across all domains for pinning SSH keys</li>
                     <li>Static key pinning for our services in apps like Auditor</li>
-                    <li>Our web services use robust OCSP stapling with Must-Staple</li>
                     <li>No persistent cookies or similar client-side state for anything other than
                     login sessions, which are set up securely using <code>SameSite=Strict</code>,
                     <code>Secure</code>, <code>HttpOnly</code>, and <code>Path=/</code> flags, prefixed with