Add an extra field to the assertion for arbitrary application data

For webrtc, we are presented with the need to embed an extra field in the assertion, namely the fingerprint of the peer connection key.

See [Section 5.6.5.2.2 of the security architecture draft spec](https://tools.ietf.org/html/draft-ietf-rtcweb-security-arch-06#section-5.6.5.2.2).

I propose we add a field to the assertion called `extra` which can contain an arbitrary object.  To provide a namespace and avoid possible collisions, the first field of the `extra` object should be the name of the application from or to which the user agent is declaring the assertion.  The meaning of the contents of the `extra` param is up to the application to interpret.  It can be ignored by applications that are not expecting it.

So for the webrtc key fingerprint case, the `extra` param might be: `extra.webrtc.fingerprint = "DE:AD:BE:EF"`.