(PE-4308) API support for certificate_status endpoint

The first commit is for revoking certs, the second is for calculating the fingerprints of certs/csrs that are in the cert_status response, and the third is simply a convenience function for getting the subject DNS alt names from a cert/csr.

As I mentioned in standup, I broke the CRL API to no longer take a list of extensions - those will be added automatically now.
Yeah I just moved it inline just to keep it isolated to where it's used.  I know that we've had troubles with setting the BC security provider and I wanted to keep the scope of that as small as possible - thus inlining it to the one method.

We've basically written these "methods" as functions with no state, unless it's been for constants or things that don't change state, unlike a Builder.  If we find that we have performance issues with this code, we'll have to change other methods in a similar fashion so I see no reason to optimize this one.