(PE-4308) API support for certificate_status endpoint

The first commit is for revoking certs, the second is for calculating the fingerprints of certs/csrs that are in the cert_status response, and the third is simply a convenience function for getting the subject DNS alt names from a cert/csr.

As I mentioned in standup, I broke the CRL API to no longer take a list of extensions - those will be added automatically now.
This is code that I wrote.  @nwolfe just moved it from a private field (below) into this method.

Yes, the `setProvider` call is necessary.  However, I made sure that we were calling it on just that one "builder" object, and not the global `Security` class or anything terrifying like that.

As to this change - I assume the reason for it was simply to eliminate state?  When I originally wrote this, I extracted this `builder` into a static field because it's unnecessary to create it and call `setProvider` on it every time , and I was unsure as to the implications of doing so ... a little FUD, admittedly, but ... I believe I dug through the code for the various methods called here and it sure seemed to be doing a lot stuff that we wouldn't want to necessarily repeat during every invocation of this method, so I think I'm :-1: on this change, but I'd be interested in other's opinions.