GlobalProtect guide: add a revocation check with OCSP

[joshdrake]

What changes

The GlobalProtect guide told readers to "Configure OCSP or CRL if your CA publishes one." This replaces that line with a new step, 7. Check certificate revocation:

• What a Smallstep authority with active revocation puts in each certificate, and how to confirm it.
• Use OCSP, and do not select Use CRL.
• Which certificate profile option decides fail-open or fail-closed when the responder cannot be reached.
• How to revoke a certificate with the API (decimal serial), and what the firewall logs when it refuses one.
• The firewall's two status caches, and the two commands that clear them.
• What happens when the firewall cannot reach the responder, including the one-hour back-off after five failures.

Step 2.6 now points to the new step.

For reviewers

• This states publicly that PAN-OS 12.1.5 cannot use the Smallstep CRL and that the OCSP answer is cached for 24 hours. Say if the wording should be softer.
• The text gives no cache duration beyond the 24-hour Next Update.
• vale reports spelling errors for sslmgr and dataplane inside the new code blocks, the same class of error the file already has for its JSON field names.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}