X509 interfaces

Replaces #1267.

**Update: simplified interfaces so the below questions are irrelevant until we expand them in future PRs**

Two outstanding questions:

- Do we want to blow up when an X509Name has multiple identical OIDs in a single Name?
- Do we want to blow up when an X509Certificate has multiple extensions with the same OID?

These are both things you Should Not Do™, but since it's all ASN.1 under the hood nothing technically prohibits the existence of certificates and names that do this.

A bit more detail than is in the PR:

- `version` will return an enum object that will correspond to v1 or v3. Leaving it an integer is a mistake many other APIs have made to their sorrow.

I've decided to go down the path of keeping the interface small and having `get_extension` and `get_item`. When the requested OID is not available we will raise the exceptions that are added here.
Would it be better if we started describing these things as "An instance of X509Certificate", instead of using the word provider?