Don't depend on legacy X.509 and ASN.1 code in BoringSSL.

This will take a lot of work to fully complete, but various intermediate steps will may give intermediate. Filing a bug and assigning to myself.

PR #248 contains one piece of it. Another will be switching from `SSLv23_method` to `TLS_with_buffers_method` in BoringSSL (yeah, the name isn't great) will cause the SSL stack to drop all references to legacy X.509 code and only support the `CRYPTO_BUFFER` APIs. This should cut out an expensive parse in configurations that don't use `OpenSSLX509Certificate`. This depends on a few APIs I need to go add to BoringSSL.

In the further future, we should cut it out of `OpenSSLX509Certificate` too, but that will require a replacement parser.