fix cert-creation: use SHA256 for certRequest too
fix cert-creation: use SHA256 for certRequest too

The problem was:

* cert-sign-requests are themselves signed by the keypair contained in
  the request. This signature defaulted to using MD5, because we did not
  provide an override to keypair.certificateRequest()
* keypair.signCertificateRequest() starts by parsing the pubkey out of
  the request. In the process of doing this, it might notice that the
  request contains an MD5 signature. We don't really care about this
  signature (it just wants the pubkey to put into the new certificate).
* a FIPS-compliant OpenSSL would see the MD5 signature and abort,
  because hey, MD5 is bad. My laptop's OpenSSL tolerated the MD5
  signature when I was testing this.
* The final generated certificate always uses SHA256, because we use
  signCertificateRequest(digestAlgorithm=sha256). Only the
  cert-sign-request signature is affected by this patch, and we throw
  out this request as soon as we build the certificate. So the output
  .pem file is not affected by this patch.

This patch allows the cert-creation process to not crash when used with
a FIPS-compliant (no-MD5) version of OpenSSL.

Thanks to Daira and LeastAuthority user "Gabe" for figuring it out.

refs ticket:141

david415/foolscap,warner/foolscap