security: More validation of certificate attributes

**Is your feature request related to a problem? Please describe.**

When using a custom CA, certs must meet certain requirements. For example, the `extendedKeyUsage` field for a node certificate must be set to both `serverAuth` and `clientAuth` (unless split node certs are used). These requirements are poorly documented; the best documentation I'm aware of is the collection of red warning boxes on https://www.cockroachlabs.com/docs/stable/create-security-certificates-openssl (the requirements are not driven by cockroachdb, they come from TLS itself or go's implementation of it). If you make a mistake here, it can be very difficult to tell what's going on.

**Describe the solution you'd like**

When we load a certificate, we should explicitly check that it has the required attributes and log a clear message if it doesn't. Note that certificates cannot be validated in isolation because the extendedKeyUsage requirement depends on the set of CA files configured.

**Describe alternatives you've considered**

A CLI command to validate a cert may also be useful, to test certs before loading them into a cockroach process.

Jira issue: CRDB-35965