fix bug in KRL generation: multiple consecutive revoked certificate
serial number ranges could be serialised to an invalid format.

Readers of a broken KRL caused by this bug will fail closed, so no
should-have-been-revoked key will be accepted.
regress test for broken consecutive revoked serial number ranges
New key API: refactor key-related functions to be more library-like,
existing API is offered as a set of wrappers.

with and ok markus@

Thanks also to Ben Hawkes, David Tomaschik, Ivan Fratric, Matthew
Dempsky and Ron Bowes for a detailed review a few months ago.
unit and fuzz tests for new key API
don't fatal() when hostname canonicalisation fails with a
ProxyCommand in use; continue and allow the ProxyCommand to
connect anyway (e.g. to a host with a name outside the DNS
behind a bastion)
when copying local->remote fails during read, don't send uninitialised
heap to the remote end. Reported by Jann Horn