not_before/not_after override doesn't work with initca

When generating a new root with `cfssl gencert -initca csr.json`, the `initca` code ignores overrides on the .ca.not_before and .ca.not_after fields in the CSR JSON file. This makes it difficult (though not impossible, because .ca.expiry is honored) to generate roots with specific expiry dates/times.

Start at the initca handling for the `cfssl gencert -initca csr.json` entry point and trace how `.ca.not_before` and `.ca.not_after` are read from the CSR JSON. Compare that behavior with the honored `.ca.expiry` field; done means the explicit date and time overrides are applied when generating a new root.

Written by the indexing model from the issue text.