(PUP-3560) Properly wrap trusted fact extensions 

The X.509 spec states that all extensions should de a DER data type wrapped inside of an DER octet string. Due to a bug in the OpenSSL::X509::Extension library we were previously just stuffing them into a DER octet string as unencoded raw data. This PR updates how we handle generating and parsing certificate requests (CSR) and also how we generate the certificates themselves.
I assume `value[0]` is looking for the `oid`? Is there a more explicit method available, e.g. `.oid`?