(PE-4308) API support for certificate_status endpoint

The first commit is for revoking certs, the second is for calculating the fingerprints of certs/csrs that are in the cert_status response, and the third is simply a convenience function for getting the subject DNS alt names from a cert/csr.

As I mentioned in standup, I broke the CRL API to no longer take a list of extensions - those will be added automatically now.
Hmm ... I don't think there are any concerns about "state re-use" here, since the builder is essentially constant.

I dug through the BouncyCastle source code some more and it doesn't actually look too bad - I don't see any global state being affected or anything else that scares me.  Probably the worst part of it is that it attempts to load a bunch of class via reflection.  Given that, I'm okay with this change.