crl2pkcs7 shouldn't include empty optional sets
crl2pkcs7 shouldn't include empty optional sets

If using crl2pkcs7 -nocrl and with no -certfiles, we shouldn't include
the implicitly tagged [0] certs and [1] crls sets as they are marked
optional and would be empty.

Reviewed-by: Paul Dale <ddec78389666b4f7c9b4d110380c848489a3e4aa@openssl.org>
Reviewed-by: Tomas Mraz <2bc6038c3dfca09b2da23c8b6da8ba884dc2dcc2@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14781)

openssl/openssl,openssl/openssl,openssl/openssl,openssl/openssl,openssl/openssl,openssl/openssl