(PE-4372) Added utilities for alt dns names

* Able to add extensions to a CSR
* Added utilities to create an Alt. DNS names extensions

This PR is for review only so people can start taking a look at it while I write some tests.
I realized that I phrased this poorly. The CSR extension requests are more or less untrusted, so you have to be very careful when copying extensions from the CSR to the cert to sign. When a CSR has the subject alt names extension you need to ensure that the CSR came from a trusted source (specifically the CSR was locally generated and submitted). In Puppet the CertificateRequest class will flat out reject CSRs that have the altnames extension added, and in the CA signing code we have the following policy:

```ruby
    # Reject unknown request extensions.
    unknown_req = csr.request_extensions.reject do |x|
      RequestExtensionWhitelist.include? x["oid"] or
        Puppet::SSL::Oids.subtree_of?('ppRegCertExt', x["oid"], true) or
        Puppet::SSL::Oids.subtree_of?('ppPrivCertExt', x["oid"], true)
    end
```

In addition the signing method has to specifically allow `subjectAltName` to be passed, so we're quite stringent in what values can be passed.

The extension creation is one of the more sensitive parts of the CA code because of the security implications, so when values are being copied it's better to reject extensions rather than accept them. In this case you may want to match https://github.com/puppetlabs/puppet/blob/master/lib/puppet/ssl/certificate_authority.rb#L323-L379 for how it handles validation, specifically in that it requires an additional argument to indicate whether dns altnames are allowed.