Add testcases exercising general CRL structure

[tnytown]

Here's a tranche of CRL testcases as outlined in pyca/cryptography#10393 (comment):

• CRL with invalid signature
• CRL signed by incorrect private key
• Empty CRL (no revoked certificates)
• Very large CRL (performance test)
• CRL with unknown critical extension
• CRL with unknown non-critical extension
• CRL with duplicate revoked entry serial numbers

• CRL entry with unknown critical extension
• CRL entry with unknown non-critical extension

[tnytown]

For most of these tests, I had to be careful not to conflate a failure to load/verify the CRL and a failure to build the chain. Consider a CRL containing an uninterpretable critical extension and an entry revoking the leaf certificate. For this case, a conformant verifier would fail on loading the CRL, while a non-conformant verifier would fail on building the chain as it interprets the CRL. I worked around this for these tests, but there may be something we can do in limbo to better support verifying CRL validation behavior.