4961: Use M2Crypto to parse proxy subject

Using openssl -subject to extract an X.509 proxy DN could have extra
/CN fields attached depending on the proxy type.  Using M2Crypto.x509 avoids
the problem -- moved the code from a tool into a library.
Merge remote-tracking branch 'origin/v3/4961' into branch_v3_2