(PUP-3560) ASN.1 encoding/decoding handled properly

Because Ruby's OpenSSL lib munges unknown extension values so bad
(it turns non-printable chars into '.' characters) there's no way to DER
decode them. I ended up having to DER decode the entire certificate and
decode the extensions manually.
(PUP-3560) CSR extensions now properly encoded

Due to a bug in the OpenSSL::X509::Extension class encoding unknown
extension types, I had to selectivley use the value either directly from
the ASN1 data, or from the value parsed by OpenSSL::X509::Extension.