Export expiration-validation info with the stashes

[jcjones]

trafficstars

I wonder if we want to verify that anything that was in the old set but isn't in the new set has expired?

Originally posted by @mozkeeler in https://github.com/mozilla/crlite/pull/48

This is doable, but the expiration-validation should happen outside of certs_to_crlite.py, as that doesn't have the information. This issue would be to save off the "deletions" that could then be checked by another tool to ensure those were actually expirations.