This commit creates a new crate-internal module, `ext`, for managing
X.509 extensions. In this commit we wire up emitting extensions managed
by this module, but do not yet convert any existing extensions to the
new arrangement. This will begin in subsequent commits.

This adds a dedicated `Extensions` struct and `Extension` trait that handle:

* tracking extensions maintaining insertion order.
* ensuring the invariant that we never add more than one instance of the
  same extension OID.
* writing the DER encoded SEQUENCE of extensions.
* writing each DER encoded extension SEQUENCE - including the OID,
  criticality, and value.

The `Extension` trait allows common operations across all extensions
like:

* getting the ext OID.
* getting the criticality (using a new `Criticality` enum).
* getting the raw DER value.

This commit lifts the authority key identifier extension into the `ext`
module.

This commit lifts the subject alternative name extension into the `ext`
module.

It additionally ensures we never write an empty SAN extension, if the
`CertificateParams` contain an empty vec of SAN names.

For the time being SAN extensions are always written as non-criticial,
but the required plumbing to handle the RFC5280 guidance on SAN ext
criticality is added for follow-up adjustment.

This commit lifts the key usage extension into the `ext` module.

TODO: Split out the non-eku related bits.

This commit lifts the extended key usage extension into the `ext`
module.

This commit lifts the name constraints extension into the `ext` module.

This commit lifts the CRL distribution points extension into the `ext` module.

This commit lifts the subject key identifier extension into the `ext`
module.

Diverging from the existing code we now adhere to the RFC 5280 advice
and always emit the SKI extension when generating a certificate.
Previously this was only done if the basic constraints specified
`IsCa::Ca` or `IsCa::ExplicitNoCa`, but not when using `IsCa::NoCa`.

This commit lifts the basic constraints extension into the `ext` module.

This commit lifts the custom extension handling into the `ext`
module.

This commit lifts the CRL number extension handling into the `ext`
module.

This commit lifts the CRL issuing distribution point extension handling
into the `ext` module.

This commit lifts the CRL entry reason code extension handling
into the `ext` module.

This commit lifts the CRL entry invalidity date extension into the `ext` module.

There are no longer any references to the lib.rs `write_x509_extension`
helper, so it is also removed.

Now that all of the CRL entry extensions have been migrated to
`Extensions` we can let that type write the `SEQUENCE` and extension
values.

There are no longer any callers to `Extensions.iter()` so we remove that
fn.