(PUP-3560) Properly wrap trusted fact extensions 

The X.509 spec states that all extensions should de a DER data type wrapped inside of an DER octet string. Due to a bug in the OpenSSL::X509::Extension library we were previously just stuffing them into a DER octet string as unencoded raw data. This PR updates how we handle generating and parsing certificate requests (CSR) and also how we generate the certificates themselves.
I assume this is looking for `BIT STRING`? If so, can we use:

<pre>
>> OpenSSL::ASN1::BIT_STRING
=> 3
</pre>