Title: #963: Include the CA basic constraint in CSRs when renewing a CA
The CSR generated by `ipa-cacert-manage renew --external-ca` did
not include the CA basic constraint:
X509v3 Basic Constraints: critical
Add a flag to certmonger::resubmit_request to specify that a
CA is being requested.
Note that this also sets pathlen to -1 which means an unlimited
pathlen. Leave it up to the issuing CA to set this.
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/963/head:pr963
git checkout pr963