Enable KEM certificate issuance via CLI

[falko-strenzke]

Fixes #4516.

TODO

• src/lib/x509/x509self.cpp: create_cert_req()
  • adds default extensions
• src/lib/x509/x509_ca.cpp: X509_CA::choose_extensions():
  • add or update basic constraints based on req.is_CA()
  • add / replace further extensions
• src/lib/x509/x509self.cpp: create_alt_name_ext()
  • set SAN value from opts

[randombit]

Basic idea is fine, could be a lot simpler in implementation see prev comments

[mouse07410]

@falko-strenzke as some of us eagerly await on this PR getting merged, might I ask you to address @randombit 's comments, or discuss with him why not...?

[falko-strenzke]

Now I realize there are quite a few things still missing, I noted the following:

     // - [ ] src/lib/x509/x509self.cpp: create_cert_req()
     //   - [ ] adds default extensions
     // - [ ] src/lib/x509/x509_ca.cpp: X509_CA::choose_extensions():
     //   - [ ] add or update basic constraints based on req.is_CA()
     //   - [ ] add / replace further extensions
     // - [ ] src/lib/x509/x509self.cpp: create_alt_name_ext()
     //   - [ ] set SAN value from opts

This might require some refactoring in order not to duplicate too much code. And the list might not be complete. I will have to postpone this for now.

[falko-strenzke]

@randombit
From my side the PR is complete now. Let's see if the CI runs through.