Bug 1032947: Change CheckNameConstraints to construct CERTCertificate instances when needed, r=keeler

--HG--
extra : rebase_source : d0bf802f4ff3fe9900ed7444c046617aa27faea9