(PE-4308) API support for certificate_status endpoint

The first commit is for revoking certs, the second is for calculating the fingerprints of certs/csrs that are in the cert_status response, and the third is simply a convenience function for getting the subject DNS alt names from a cert/csr.

As I mentioned in standup, I broke the CRL API to no longer take a list of extensions - those will be added automatically now.
I think this diff must be wonky, because it looks like there was no `builder` object prior to your change, though it is clearly referenced in the (unmodified) line below.  What was `builder` before?

Also, is the `setProvider` call above mandatory?  That is the same kind of method that, in the past, I've seen cause bad side effects by modifying global state in the java Security framework.  In this case it doesn't necessarily look like it is doing that, but it might be worth making sure.