FIx anomalous behaviour of the SKID and AKID extensions in CSRs and X.509 certs

[vavroch2010]

[vdukhovni]

No description provided.

The SKID and AKID options were "improved" to be added by default under various conditions on the subject and issuer, with a new "none" value available to override that default action when desired.

These changes were motivated by a desire to more strictly adhere to RFC5280 issuer requirements automatically by default. Previously the choice of whether to strictly conform or not was up to user's choice of extensions to set.

Sadly, the machinery in question involved some "apps" logic to paper over pitfalls that are not addressed when used by extant API-only applications. And the basic control flow of trying to impose default choices as a final step, rather than an initial state is flawed.

This needs rework, in both he APIs and apps, and ultimate a non-trivial refactoring of the x509 and req apps.