introduced gnutls_privkey_import_ext3()

That function allows copying an external specified private
key, as well as allow variability on the capabilities of an
external key.
doc update
added missing prototype
certtool: updated the extended key usage documentation
Verify key purpose on intermediate certificate if GNUTLS_VERIFY_KEY_PURPOSE_ON_INTERMEDIATE is specified

That introduces the verification flag GNUTLS_VERIFY_KEY_PURPOSE_ON_INTERMEDIATE,
and the verification result GNUTLS_CERT_PURPOSE_MISMATCH. The reason that this
verification test must be explicitly enabled is because it is only defined in CA
Forum's Baseline requirements 1.1.9 but not any IETF document.
tests: Added checks for key purpose verification
doc update