capsule-tool: add an option to extract certificate data

Add an `--extract-cert' command line option to extract the certificate data
from a capsule, which can be further analyzed with e.g. `openssl pkcs7
-inform der'.

Also, add a unit test.

Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>