modify basic constraints in CaProfile to take a hash of form:

{ "ca" => (true/false), "path_length" => (integer) }
path_length is optional if ca is true and not allowed when ca is false
config spec improvements to match new basic_constraints behaviors
improve documentation for new basic_constraints behaviors