[jmestwa-coder]

load_der_ocsp_response rejects a successful response with no responseBytes, but not the reverse:

• a tryLater, unauthorized or other non-successful status that still carries a BasicOCSPResponse loads fine
• every BasicResponse property then returns the embedded data instead of raising ValueError as documented, e.g. resp-sha256.der with the status flipped to tryLater reports TRY_LATER and certificate_status GOOD
• RFC 6960 4.2.1 only allows responseBytes with a successful status, and responseStatus sits outside the signed data

Now raises ValueError at load time, with a regression test and a changelog entry.