Reduce nonce redemption flake by giving WFE time to mark SubConns READY

[aarongable]

In noncebalancer, add documentation and change names to make the roles played by each type clearer. Unexport the pickerBuilder and picker types, since they aren't directly referenced anywhere outside of the package's init function.

In the WFE, move the nonceWellFormed error message upwards into validNonce, alongside the other errors returned by that function. Change that same error message to say "malformed" rather than "invalid", to differentiate it from redemption failures and to match the corresponding metric label. Replace the JWSInvalidNonce metric label with two more-specific metric labels JWSNoBackendNonce and JWSExpiredNonce, for better insight into whether nonce redemption failures are due to backends shutting down or due to backends expiring old nonces.

Finally, in the python integration tests, increase how long we wait between retries from 10ms to (up to) 600ms. This gives the WFE's NonceRedeemer gRPC client enough time to move its SubConns from the CONNECTING state to the READY state, and in practice seems to eliminate flaky nonce redemption errors in CI.

Fixes #8385

[jsha]

Other than a question, this looks good to me to land as-is. During standup we discussed some additional changes to add internal logging of more details on error. I think that can land as a followup if you prefer, or as part of this PR.