Extensions checks.

Checks whether certificate has all extensions required/prohibited based on BRs with correct criticality. Also added small is_self_signed method to certificate, so we can tell whether the certificate is root or not.
That's fine - as I clarified offline, the comment is about the documentation.