Add OCSP support sufficient for client-side OCSP stapling for end-entity certificates

[briansmith]

In particular, implement OCSP validation but not OCSP fetching or the ability to look up OCSP responder URLs from a certificate's AIA. Neither is it required to implement the must-staple feature extension or OCSP for CA certificates. Some of those are things we should do, but they'll be done in separate issues.

[ctz]

I'd like to make a start on this, if you haven't already?

[briansmith]

I think, at the very least, we should fix #9 first. I don't want to add more technical debt by adding more code that depends on time.

Otherwise, I do have a bunch of work already done related to this but I'm not sure how to deal with it yet.