(PUP-3560) Properly wrap trusted fact extensions 

The X.509 spec states that all extensions should de a DER data type wrapped inside of an DER octet string. Due to a bug in the OpenSSL::X509::Extension library we were previously just stuffing them into a DER octet string as unencoded raw data. This PR updates how we handle generating and parsing certificate requests (CSR) and also how we generate the certificates themselves.
According to the spec at http://tools.ietf.org/html/rfc5280#section-4.1 the extensions are contained within a sequence with the _context-specific_  tag of 3 which overrides the normal _universal_ tag of 16. But this does raise a good point, the predicate should be something like: `(data.tag == 3) && (data.tag.class == :CONTEXT-SPECIFIC)` since tags by themselves don't fully identify an ASN.1 type.