Add san module - #10478

In #10478 we added a `san.SAN` class, with two subclasses `san.DNSName`
and `san.IPAddress`, so we can carry type information about identifiers
through the Certbot code. This PR plumbs through those types in most
Certbot-internal code. Note that this does not change the `acme` module,
which uses `messages.Identifier`. It also tries to leave alone the code
paths into plugins.

This does not add a CLI flag to request an IP address certificate. That
will be in a followup PR.

Part of #10346

if you dislike the general idea of this PR, feel free to just close it,
but i'm scheduled to release the next version of certbot a week from
today and i personally didn't like how
[newsfragments](https://github.com/certbot/certbot/tree/main/newsfragments)
is so empty despite us having done a lot of work on certbot lately

this PR just adds a simple newsfragment highlighting/teasing the work
jsha has been leading on support for IP address certificates which i
imagine would be of interest to some people in the community

```
$ towncrier build --draft --version 5.2.0
Loading template...
Finding news fragments...
Rendering news fragments...
Draft only -- nothing has been written.
What is seen below is what would be written.

## 5.2.0 - 2025-11-25

### Added

- Support for Python 3.14 was added.
  ([#10477](#10477))

### Changed

- While nothing significant should have changed from the user's perspective,
  we've been doing a lot of internal refactoring in preparation for soon adding
  support for IP address certificates to Certbot.
  ([#10468](#10468),
  [#10478](#10478))
```

see the thread at
https://opensource.eff.org/eff-open-source/pl/f5yx4a4q4j8zjyqpmath494jge
for details

since it's only the `v5.2.0` github tag that's borked, we could in
theory try and use like `v5.2.0-2` or something, but there are
[places](https://github.com/certbot/certbot/blob/259dfadb43cc52cb06ba57883766497faaf72b59/.azure-pipelines/release.yml#L10)
in the release pipeline that use the GH tag as input to the assets they
build, so i think just skipping 5.2.0 altogether is simpler, easier, and
safer

with this change, here's the proposed changelog
```
$ towncrier build --draft --version 5.2.1
Loading template...
Finding news fragments...
Rendering news fragments...
Draft only -- nothing has been written.
What is seen below is what would be written.

## 5.2.1 - 2025-12-02

### Added

- Support for Python 3.14 was added.
  ([#10477](#10477))

### Changed

- While nothing significant should have changed from the user's perspective,
  we've been doing a lot of internal refactoring in preparation for soon adding
  support for IP address certificates to Certbot.
  ([#10468](#10468),
  [#10478](#10478))

### Fixed

- Removed `vhost_combined` and `vhost_common` log formats from included Apache
  configuration file. ([#9769](#9769))
- Due to a mistake on our end playing with GitHub's new [immutable
  releases](https://github.blog/changelog/2025-10-28-immutable-releases-are-now-generally-available/)
  feature that prevented our CI from uploading additional release assets,
  Certbot 5.2.0 was not and will not be uploaded to most platforms. Instead,
  that version number will be skipped and we'll go straight to 5.2.1.
  ([#10501](#10501))