(PUP-1409) add authorityKeyIdentifier to client certificates

as discussed in the ticket this will add the authorityKeyIdentifier that
is not required, but recommended to add to certs signed by a CA
conforming to RFC 5280. This extension takes the subjectKeyIdentifier of
the CA certificate and adds it as keyid to authorityKeyIdentifier.
This PR also adds a test to make sure the extension is correctly added
to the resulting certificate.
Note that this change depends on PUP-1387 since it uses the
ExtensionFactory as well, without PUP-1387 this test would fail.