CAS-1468: X509SubjectAlternativeNameUPNPrincipalResolver

Microsoft (and others) support the embedding of a UserPrincipalName object as a SubjectAlternateName extension within an X509 certificate, allowing properly-empowered certificates to be used for network logon (via SmartCards, or alternately by 'soft certs' in certain environments). An X509UserPrincipalNameResolver class would make the use of CAS as a web single sign on solution incredibly easy for AD domains with an existing PKI infrastructure.
The subjectAlternativeName field has a variable number of items determined by the certificate request used to generate the cert. It's common (arguably required by most SSL implementations) to contain at least one member, but doesn't hurt to do a bounds check. Ultimately parsing would fail, but perhaps it's more user friendly to throw something other than IndexOutOfBoundsException.