Add support for CAA

[dadrian]

We should implement this in two stages:

1. Standalone CAA package, probably as a subpackage of verifier/. This would take a cert and a parent, and return CAA status.
2. Add an option to VerificationOptions to do CAA, and expose the results in VerificationResult.