Support must-staple extension

[wgreenberg]

It'd be nice to move certbot off of using boulder for its integration tests (certbot/certbot#9898), and we largely have, but the one remaining boulder-only test that remains is for issuing an OCSP Must-Staple enabled certificate. We'd love if pebble supported this so we can simplify our test environment! Happy to open a PR if you all think this would be a welcome addition.

[jsha]

That sounds great, particularly if it lets certbot use pebble for integration tests! I'll caveat that Boulder's handling of the Must-Staple extension in CSRs is not fully specified by RFCs, but I think it's worth simulating anyhow.