bug 987262 - mozilla::pkix: refactor Nested AtEnd() checks in pkixder.h r=briansmith