Bug 970542, Part 1: Refactor name matching within CN AVAs to reduce duplicate logic, r=keeler

--HG--
extra : rebase_source : f129b24c58377f34ac7d80ee7d5e8775635843ff
Bug 970542, Part 2: DNSName name constraint matching, r=keeler

--HG--
extra : rebase_source : 50b1a7d5d9da97cc64e09d5e6cdc41b8200c3551
Bug 970542, Part 3: IPAddress name constraint matching, r=keeler

--HG--
extra : rebase_source : f47ef9ead3323704595b91873811d1ead2403839
Bug 970542, Part 4: DirectoryName name constraint matching, r=keeler

--HG--
extra : rebase_source : 01770088851823ae1005227dcd43d82d015f4b0e
Bug 970542, Part 5: New name constraint implementation, r=keeler, r=mmc

--HG--
extra : rebase_source : 849161ac892b05e5ff2d5552c632fc647d309085
Bug 970542, Part 6: DNSName name constraint tests, r=keeler

--HG--
extra : rebase_source : ec31862fc25cfcba1454ae862a26e7a27513e9b6
Bug 970542, Part 7: More CN-ID name constraint tests, r=keeler

--HG--
extra : rebase_source : 7a3d1d31cdc08ea1b989428cfc85f60a00528c72
Bug 970542, Part 8: IPAddress name constraint tests, r=keeler

--HG--
extra : rebase_source : e8cc0158248d4621da19dfef56089957af417f73
Bug 970542, Part 9: Better document name constraints as reference IDs, r=keeler

--HG--
extra : rebase_source : 60413188771454081226d58d03156c15ce795ca7