(PUP-3560) Properly wrap trusted fact extensions 

The X.509 spec states that all extensions should de a DER data type wrapped inside of an DER octet string. Due to a bug in the OpenSSL::X509::Extension library we were previously just stuffing them into a DER octet string as unencoded raw data. This PR updates how we handle generating and parsing certificate requests (CSR) and also how we generate the certificates themselves.
Referring to the spec I posted below, at the top level a certificate is composed of a sequence containing 3 elements. The first element (_TBSCertificate_) is itself a sequence containing the direct certificate data itself.  So, `asn1_cert_data.value[0]` means "give me that first sequence that contains all the cert data.