(PE-4617) JVM Cert authority can now retrieve decoded extension values

I would put this up with the other name/x500 test and not lump it with this one since it doesn't depend on it.
You should be able to use one of the existing certs/CRLs/pems, and/or programmatically create an X500Principal.
Then we can get rid of the top-level let block for `cert-with-exts`.