(PE-4308) API support for certificate_status endpoint

The first commit is for revoking certs, the second is for calculating the fingerprints of certs/csrs that are in the cert_status response, and the third is simply a convenience function for getting the subject DNS alt names from a cert/csr.

As I mentioned in standup, I broke the CRL API to no longer take a list of extensions - those will be added automatically now.