OpenSSLX509CRLEntry.hasUnsupportedCriticalExtension shouldn't call X509_supported_extensions

Noticed this idly... hasUnsupportedCriticalExtension on OpenSSLX509CRLEntry is implemented with X509_supported_extensions, but X509_supported_extensions only lists extensions that we implement in a certificate context.

For X509_REVOKED, BoringSSL just doesn't implement any critical extensions, so the replacement should be pretty straightforward. Although this does beg the question _whose_ implementation these functions are meant to query, since Conscrypt isn't even using BoringSSL's verifier... :-)