(#23201) Expose custom extensions in the certificate

Certificates generated by the Puppet CA come with a number of standard
extensions, but users may want to create certs with custom extensions
and then retrieve them later. This commit adds a mechanism for adding
extension requests to the CSR from the csr_attributes file and exposes
custom extensions on the signed certificate.