More CRL test cases

[tnytown]

Some CRL cases from #174.

• xfail: CRL has wrong version (not 2, i.e. literal 1)
• xfail: thisUpdate and nextUpdate must use the same date encoding rules as the rest of RFC 5280
• xfail: revokedCertificates must not be present if empty (i.e. must not be an empty SEQUENCE OF)
• pass: CRL contains revocation but not active yet (revocation date in the future)
• xfail: CRL root is missing cRLSign: TRUE
• pass: CRL revokes a similar-but-differ cert (same except for serial number, which is all that matters)
• xfail: CRL has the wrong issuer (signed by root but issuer name does not match)

[woodruffw]

I'm going to reopen this from an upstream branch to push the regression automation through.

[woodruffw]

#440.