Omit default cA flag value as required by spec

[djc]

Proposed release notes

Previous versions generated DER that is strictly incompatible with the spec, writing an explicit false value for IsCa::ExplicitNoCa where this should be omitted (as it's the default).

Fixes #443.

[GermanCoding]

I'm not familar with the codebase, but doesn't this line have the same problem?

rcgen/rcgen/src/certificate.rs

Line 267 in edc6bb6

writer.next().write_bool(is_ca.is_some()); // cA flag

(Looks like this is the CSR path - I didn't do any verification for CSRs, but I assume it's a similar story there?)

[djc]

I'm not familar with the codebase, but doesn't this line have the same problem?

rcgen/rcgen/src/certificate.rs

Line 267 in edc6bb6

writer.next().write_bool(is_ca.is_some()); // cA flag

(Looks like this is the CSR path - I didn't do any verification for CSRs, but I assume it's a similar story there?)

Thanks for flagging that! Reworked this to avoid duplicating logic between CSR and certificate encoding.

[djc]

@ctz @cpu hope you don't mind the short ping interval -- would like a re-review after I substantially changed the PR to deduplicate a bunch of code.

[cpu]

Thanks for picking this up & doing the extra tidying.