The RA rejected wildcard authorizations with DNS-Account-01 challenges
during reuse, though the PA offers DNS-Account-01 for wildcards.

In ra.go:2244-2248, the NewOrder() validation only accepted DNS-01 for
wildcards. This check predates DNS-Account-01 wildcard support (added
after commit 52615d9).

Changes:
- Accept both DNS-01 and DNS-Account-01 for wildcard reuse
- Split validation into two checks (count vs type)
- Add TestNewOrderAuthzReuseDNSAccount01 unit test

The bug only affected authorization reuse (not new authorizations),
which is why existing tests using random domains didn't expose it.

Adds TestDNSAccount01WildcardAuthorizationReuse to verify that wildcard
authorizations with DNS-Account-01 challenges can be reused correctly.

The test:
- Creates a wildcard order with DNS-Account-01
- Completes the challenge to get a valid authorization
- Creates a second order for the same wildcard domain
- Verifies the same authorization is reused (same URL)
- Verifies the authorization is already valid (no re-validation)
- Verifies the DNS-Account-01 challenge type is preserved

This test fills a gap in Boulder's integration test coverage - no
existing Go integration tests verify authorization reuse end-to-end.

Reverted to single combined check to maintain backward compatibility
with existing test expectations. The fix still accepts both DNS-01 and
DNS-Account-01 for wildcard authorization reuse, but uses the original
generic error message format: "with invalid challenge(s)"

This avoids needing to modify existing tests while still fixing the bug.

Add 2 assertions checking that authorization reuse actually occurs:
- Order contains exactly one authorization
- Authorization ID matches the mock (ID "1")

Previously the test only checked for absence of errors, which could
pass even if a new authorization was created instead of reusing the
existing one.

The RA accepted DNS-Account-01 for wildcard authorization reuse without
checking features.Get().DNSAccount01Enabled.

Changes:
- Add feature flag check in ra.go wildcard validation
- Enable flag in TestNewOrderAuthzReuseDNSAccount01
- Add TestNewOrderAuthzReuseDNSAccount01Disabled for flag-off state

When disabled, only DNS-01 is accepted for wildcard authorization reuse.
When enabled, both DNS-01 and DNS-Account-01 are accepted.

Refactor wildcard authorization validation:
- Split gnarly conditional into nested checks
- Extract chall and dnsAccount01Enabled variables
- Separate error message for unexpected challenge count
- Update test expectation for new error message

Test improvements:
- Change final assertions to t.Errorf() (non-fatal)
- Add error logging to cleanup functions
- Prevent panics from nil-value derefs in test setup

Pending wildcard authorizations can have 2 challenges
(DNS-01 + DNS-Account-01) when DNS-Account-01 is enabled.
Previous check rejected these valid authorizations.

Changes:
- Allow maxChallenges=2 for pending authz when feature enabled
- Validate all challenges in list (not just first)
- Update test to use pending authz with both challenge types

Trust the PA/SA to handle challenge counts correctly and only verify
that wildcard authzs don't contain invalid challenge types.