Rework X509 extension code

The extension-writing code currently duplicates each extension's presence condition away from the code that encodes it (e.g. the should_write_exts gate vs. write_extensions), which has already produced bugs where requested extensions were silently dropped.

I think we should rework this to represent extensions with an internal Extension trait implemented once per extension type, with per-type from_params constructors so presence logic lives beside encoding, plus an Extensions collection that rejects duplicate OIDs (fixing https://github.com/rustls/rcgen/issues/155) and only emits the outer extensions wrapper when the built collection is non-empty. This would make emptiness observed rather than predicted, and eliminating the gate-drift bug class.

I had started on some of this in a very stale WIP branch and we should revive that before a next major release.