nss: let nss_{cache,load}_crl return CURLcode
nss: make crl_der allocated on heap

... and spell it as crl_der instead of crlDER
nss: fix a memory leak when CURLOPT_CRLFILE is used