add path-len to basic-constraints

[garthy]

Add support for path-len in basic constraints

...
    not-after "9999-12-31T23:59:59Z"
    extensions {
        basic-constraints critical=true ca=true path-len=0
    subject-key-identifier critical=false
        key-usage critical=true {
...