Implements RenderForm/ParseForm on the provider: users can hit /check
with just a domain name; ParseForm resolves CAA records via direct DNS
queries (walking up the label tree per RFC 8659) and hands the SDK a
synthetic service payload so the standard Collect → Evaluate pipeline
runs without a happyDomain host. TLS probes are not gathered here, so
the rule reports StatusUnknown for the TLS cross-check in this mode.
Each distinct TLS issuer now produces its own CheckState with Subject
set to the issuer label, instead of being folded into a single
concatenated status. Aligns with the SDK v2 contract (see
checker-sdk-go/migrate-v2.md).
