Support creation of CSRs/certs with the OCSP "must staple" attribute

[Castaglia]

Add a command-line option, e.g. --must-staple, which adds the necessary extra config to the file:

[ req ]
req_extensions = cert_tool_req_ext

[ cert_tool_req_ext ]
1.3.6.1.5.5.7.1.24=DER:30:03:02:01:05

See:

• https://community.letsencrypt.org/t/improving-revocation-will-lets-encrypt-support-ocsp-must-staple/4334/47