Only specify cert sign / CRL sign for CAs and only specify extended key usages for clients.
Only specify cert sign / CRL sign for CAs and only specify extended key
usages for clients.

This will hopefully fully get rid of the various incompatible ways that
various browsers/libraries deal with key usages.

Fixes #987

joelthompson/vault,mgk/vault,cimarron-pistoncloud/vault,Aloomaio/vault,andrewstuart/vault,kingland/vault,hartsock/vault,joelthompson/vault,kingland/vault,mhurne/vault,jmhardison/vault,rnaveiras/vault,mgk/vault,hartsock/vault,Banno/vault,quixoten/vault,annanay25/vault,annanay25/vault,geckoboard/vault,rnaveiras/vault,andrewstuart/vault,mymercurialsky/vault,lirao/vault,sepiroth887/vault,grunzwei/vault,hashicorp/vault,memory/vault,ryon/vault,kingland/vault,grunzwei/vault,hashbrowncipher/vault,memory/vault,careyblack/vault,hartsock/vault,martin-ducar-gd/vault,kenbreeman/vault,doubledutch/vault,danielsomerfield/vault,careyblack/vault,jgcallero/vault,skippy/vault,mymercurialsky/vault,doubledutch/vault,doubledutch/vault,hashicorp/vault,MonsantoCo/vault,martin-ducar-gd/vault,lirao/vault,hashicorp/vault,kenbreeman/vault,andrewstuart/vault,joelthompson/vault,rnaveiras/vault,quixoten/vault,skippy/vault,grunzwei/vault,jmhardison/vault,geckoboard/vault,kingland/vault,LolalyLuo/vault,Caiyeon/vault,joelthompson/vault,mgk/vault,quixoten/vault,Caiyeon/vault,chrishoffman/vault,kenbreeman/vault,doodles526/vault,annanay25/vault,careyblack/vault,ryon/vault,mgk/vault,doodles526/vault,hashbrowncipher/vault,careyblack/vault,MonsantoCo/vault,michaelansel/vault,hashicorp/vault,geckoboard/vault,kenbreeman/vault,andrewstuart/vault,Aloomaio/vault,andrewstuart/vault,quixoten/vault,deverton/hashicorp-vault,careyblack/vault,Banno/vault,kenbreeman/vault,annanay25/vault,sepiroth887/vault,LolalyLuo/vault,hashbrowncipher/vault,peteryhwong/vault,sepiroth887/vault,danielsomerfield/vault,hashbrowncipher/vault,kingland/vault,geckoboard/vault,Aloomaio/vault,grunzwei/vault,hashicorp/vault,peteryhwong/vault,grunzwei/vault,lemondrank/vault,rnaveiras/vault,hashbrowncipher/vault,doubledutch/vault,jam-pot/vault,michaelansel/vault,rnaveiras/vault,wjam/vault,hartsock/vault,sepiroth887/vault,chrishoffman/vault,lemondrank/vault,geckoboard/vault,jmhardison/vault,Aloomaio/vault,jgcallero/vault,naunga/vault,naunga/vault,sepiroth887/vault,deverton/hashicorp-vault,jmhardison/vault,annanay25/vault,tallpauley/vault,cimarron-pistoncloud/vault,jam-pot/vault,tallpauley/vault,hartsock/vault,jmhardison/vault,doubledutch/vault,hashicorp/vault,mhurne/vault,wjam/vault