.onion lint

[kumarde]

The EV Guidelines require certificates issued for .onion include the cabf-TorServiceDescriptor extension, defined in the EV Guidelines, as part of these certificates. This is required by Section 11.7.1 (1) of the EV Guidelines, reading: "For a Certificate issued to a Domain Name with .onion in the right-most label of the Domain Name, the CA SHALL confirm that, as of the date the Certificate was issued, the Applicant’s control over the .onion Domain Name in accordance with Appendix F."

[cpu]

Updating this issue based on the plan discussed in #263:

• - Close the old PR that combined parsing and linting (lints: ballot 144/201 .onion linting. #263)
• - Open a new PR with the two lints that don't rely on TorServiceDescriptorHash parsing (lints: enforce .onion certs are EV, have <15mo expiry #265)
• - Open a zcrypto issue for TorServiceDescriptorHash parsing (Parse TorServiceDescriptorHash x509 extension zcrypto#188)
• - Open a zcrypto PR to add TorServiceDescriptorHash parsing (x509: support parsing CABF TorServiceDescriptor extension. zcrypto#189)
• - Open a zlint PR to add a lint for the TorServiceDescriptorHash that uses the zcrypto parsing logic. (lints: add lint for TorServiceDescriptorHash ext. #275)
• - Work through zlint PR feedback.