Extensions cleanup and support for subjectAltNames on SigningRequest.

These changes have been a *long* time coming.

Extensions finally support object equality.

Extensions will parse correctly from (highly limited) sample size
so will likely need to be extended. Unfortunately, due to asymmetric
set vs parse in OpenSSL you can't parse a cert with an extension you
want and copy it to a new cert.

Conveniences around creating subjectAltNames for CSRs.