Fix the subject key identifier.

Now matches the old certificates provided you have not re-registered. (this is
based off the system's identity cert)

Calculating the value is non-trivial, so to avoid writing ASN1 / DER
parsing/encoding code, we leverage bouncycastle libraries for this, but skip
the part where bc calculates the SHA-1 hash, thus we remain FIPS compliant.
Fix authority key identifier.

Similar to SKI, we use bouncycastle to work with ASN1/DER and get us the values
we need, but JSS does the actual hashing.
Code cleanup.