We have changed the format of the username identity to not look
like an email, and so we also needed to change which SAN the username
was set in. Now using OtherName, I've added some custom unmarshalling
to extract the OtherName SAN, because Go doesn't support this SAN type.

Note in verify.go, I had to handle when the extension was critical.
Since Go doesn't handle the extension, but it must be marked critical
according to RFC5280, the cert will fail verification. We can simply
remove the extension from the list of unhandled extensions before
verifying.

Signed-off-by: Hayden Blauzvern <hblauzvern@google.com>

Signed-off-by: Hayden Blauzvern <hblauzvern@google.com>

Signed-off-by: Hayden Blauzvern <hblauzvern@google.com>