Renew symlink safety (#3560)

Re-do the fix for #3497 to ensure it works in all cases.

* If lineages are in an inconsistent (non-deployed) state, deploy them

* Test new _handle_identical_cert case

* Move lineage.has_pending_deployment() check up to _auth_from_domains

Less conceptually nice, but in the "renew" verb case it wasn't being called :(

* Swap _auth_from_domains return type

 * It now matches _treat_as_renewal & _handle_identical_cert_request etc

* Revert "Move lineage.has_pending_deployment() check up to _auth_from_domains"

This reverts commit a7fe734d73.

* Move test back to handle_identical_cert_request

* We need to check for non-deployment on two separate code paths

 - Once high up in "renew" (because failure to be deployed stops us from
   divind down the stack)
 - Once way down in _handle_identical_cert_request (because that's where it
   makes the most sense for run / certonly)
 - So refactor that work into storage.py

* We don't necessarily reinstall

certbot/renewal.py

@@ -341,6 +341,7 @@ def renew_all_lineages(config):
             else:
                 # XXX: ensure that each call here replaces the previous one
                 zope.component.provideUtility(lineage_config)
+                renewal_candidate.ensure_deployed()
                 if should_renew(lineage_config, renewal_candidate):
                     plugins = plugins_disco.PluginsRegistry.find_all()
                     from certbot import main