Old openssl does not handle "openssl req -addext"

In older openssl versions (e.g. "OpenSSL 1.0.2k-fips 26 Jan 2017" as found on CentOS 7 systems) the `req` subcommand does not handle the `-addext` option:
```
$ openssl req -addext
unknown option -addext
...
```
This leads to test failues in t/sslmaker.t. A sample test report:
http://www.cpantesters.org/cpan/report/a9a021b2-63b6-11ee-95df-892a6e8775ea

Review t/sslmaker.t and the OpenSSL command path it exercises, using the reported OpenSSL 1.0.2k-fips behavior as the starting case. Done means the affected tests no longer fail because that version rejects `req -addext`, and the certificate-authority tests pass.

Written by the indexing model from the issue text.