CRL fixes

[czechow-shadow]

• CRL fixes

  • Parsing CRL with no RevokedCertificates (empty list) fails
  • Parsing CRL with CRL Extensions or RevokedCertificates Extensions fails

• Fixing approach: Extensions parsing/serialization change

  • Moved "Container " outside of the "Extensions", as "Extensions" are encoded on different Containers, and sometimes without a Container
  • One could have newtypes around "Extensions" and instances of ASN1Object defined for them, that was another options which was considered.

• Testing

  • Tests extended with arbitrary types for Extensions in Revoked Certificates
  • Real CRLs added to x509-util/crls/ (rfc5280 and Google)