Support all Fulcio Cert Extensions

[jkjell]

Fulcio has a publicly export API now for all of the x509 cert extensions. We should support these as constraints for functionaries and policy signatories.

https://github.com/sigstore/fulcio/blob/main/pkg/certificate/extensions.go

[jkjell]

It's important to note that the support we have for SPIFFE/SPIRE that should not break when adding these new extensions. The current set of constraints were put in place for that: https://github.com/in-toto/go-witness/blob/main/policy/constraints.go#L29. Additionally, the requirements for the extensions are listed here.