Extensions checks.

Checks whether certificate has all extensions required/prohibited based on BRs with correct criticality. Also added small is_self_signed method to certificate, so we can tell whether the certificate is root or not.
(1) would be nice to have the parameters properly formatted.
(2) certificate's criticality? certificates' criticality? it's unclear if it's just the criticality bit.