X509 interfaces

Replaces #1267.

**Update: simplified interfaces so the below questions are irrelevant until we expand them in future PRs**

Two outstanding questions:

- Do we want to blow up when an X509Name has multiple identical OIDs in a single Name?
- Do we want to blow up when an X509Certificate has multiple extensions with the same OID?

These are both things you Should Not Do™, but since it's all ASN.1 under the hood nothing technically prohibits the existence of certificates and names that do this.

A bit more detail than is in the PR:

- `version` will return an enum object that will correspond to v1 or v3. Leaving it an integer is a mistake many other APIs have made to their sorrow.

I've decided to go down the path of keeping the interface small and having `get_extension` and `get_item`. When the requested OID is not available we will raise the exceptions that are added here.
> On Nov 24, 2014, at 4:18 PM, Paul Kehrer <notifications@github.com> wrote:
> 
> In docs/hazmat/primitives/interfaces.rst:
> 
> > +
> > +    .. versionadded:: 0.7
> > +
> > +    .. method:: fingerprint(algorithm)
> > +
> > +        :param algorithm: A
> > +            :class:`~cryptography.hazmat.primitives.interfaces.HashAlgorithm`
> > +            that will be used by this context.
> > +
> > +        :return: The fingerprint using the supplied hash algorithm as bytes.
> > +
> > +    .. attribute:: serial
> > +
> > +        :type: int
> > +
> > +        The serial as a Python integer.
> Serial numbers are encoded in X.509 certificates as ASN.1 integers, so they follow the distinguished encoding rules of ASN.1. Libraries like BouncyCastle, OpenSSL, and NSS all parse these values and represent them as arbitrary width integers internally.
> 
Ah, ok. I take back my objection then. I didn’t actually go look that up. I just remembered seeing the command-line OpenSSL tools sometimes dump serial number values out in hex, without attempting to convert them to integers in all cases.

Specifically, where I noticed this was on OpenSSL dumping an AuthorityKeyIdentifier, which seems to be defined as:

   AuthorityKeyIdentifier ::= SEQUENCE {
      keyIdentifier             [0] KeyIdentifier           OPTIONAL,
      authorityCertIssuer       [1] GeneralNames            OPTIONAL,
      authorityCertSerialNumber [2] CertificateSerialNumber OPTIONAL  }

   KeyIdentifier ::= OCTET STRING
   CertificateSerialNumber  ::=  INTEGER
Here, rather than printing the serial number as an integer, I get output like:

        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                B1:95:DB:60:65:54:15:F7:3C:AC:81:AF:89:F2:13:ED:E0:9D:4E:44
            X509v3 Authority Key Identifier: 
                keyid:B1:95:DB:60:65:54:15:F7:3C:AC:81:AF:89:F2:13:ED:E0:9D:4E:44
                DirName:/C=XX/O=YYY/OU=ZZZZ/CN=foo.example.com
                serial:21:1E:4D:00

Given the ASN.1 definition, though, I guess this is just a limitation in the OpenSSL command line tool. It seems to be a little bit better when dumping the main serial number. There, it outputs:

    Data:
        Version: 3 (0x2)
        Serial Number: 555633920 (0x211e4d00)
-- 
Ron Frederick
ronf@timeheart.net