Add support for EKUs (and fix ./test)

[mrnerdhair]

Add a parameter to support issuing certificates with custom EKUs. (Use case: I need to issue certificates with BitLocker OIDs in the EKU extension.) I hope to extend this in the future to include shorthand strings for common EKUs, like OpenSSL's clientAuth and serverAuth keywords. This code also provides a nice place for future development to add arbitrary extensions of any type, right before cmd/request_cert.go:177.

(Also, fixes a couple format string errors preventing ./test from working.)

[CLAassistant]

All committers have signed the CLA.