crypto/x509: CreateCertificate should omit extensions if there aren't any

[rolandshoemaker]

When creating a certificate, if there are no extensions, the extensions SEQUENCE should be omitted, per RFC 5280 (SEQUENCE SIZE (1..MAX)). Fix is relatively simple.

Example of a cert that has an empty extensions SEQUENCE (generated using https://go.dev/play/p/QK11453Bcu3.)

[gopherbot]

Change https://go.dev/cl/399827 mentions this issue: crypto/x509: omit empty extensions SEQUENCE