Support for X509 v3 extensions on Certify

[bgrieder]

After #101, Certify can certify a public key, but no X509 V3 extension can be provided.

Support for adding extensions should be provided in the same form as OpenSSL i.e. an extensions file with sample content

[ v3_ca ]
basicConstraints=CA:TRUE,pathlen:0
keyUsage=keyCertSign,digitalSignature
extendedKeyUsage=emailProtection
crlDistributionPoints=URI:http://cse.example.com/crl.pem