Release x509 0.9.0

[hannesm]

CHANGES:

• BREAKING add a whitelist of hash algorithms used for signatures. The default
  whitelist is the SHA-2 family (without SHA-224), Validation.valid_ca{,s} use
  all algorithms as default
  reported by @emillon in Certificate verification allows dangerous algorithms mirleft/ocaml-x509#123, fixed in hash algorithms used for signatures mirleft/ocaml-x509#128
• BREAKING Certificate.hostnames and Signing_request.hostnames (new) return a
  set of [`Wildcard|`Strict] * [`host] Domain_name.t (Certificate.Host_set.t)
  reported by @mmaker in to topkg mirleft/ocaml-x509#88, fixed in provide Signing_request.hostnames, revise validation to use a hostname (instead of a tuple) mirleft/ocaml-x509#127
• BREAKING provide Signing_request.hostnames, revise validation to use a hostname (instead of a tuple) mirleft/ocaml-x509#127 Signing_request.sign returns a result type now, an error is
  returned if the signing request was not properly signed
• BREAKING provide Signing_request.hostnames, revise validation to use a hostname (instead of a tuple) mirleft/ocaml-x509#127 Validation.{verify_chain_of_trust, trust_key_fingerprint,
  trust_cert_fingerptint} and the type Authenticator.t changed, no longer use
  of a Certificate.host, but instead a [`host] Domain_name.t (previously, it was
  a pair)
• BUGFIX support AlgorithmIdentifier of RSA signature algorithms with parameter
  not present
  reported by @Ulrar in Invalid_argument "X509: failed to parse certificate" when using X509.Encoding.Pem.Certificate.of_pem_cstruct1 mirleft/ocaml-x509#108, fixed in Algorithm: allow the parameter field of RSA Signature Algorithm to be not present mirleft/ocaml-x509#129
• BUGFIX provide Signing_request.hostnames, revise validation to use a hostname (instead of a tuple) mirleft/ocaml-x509#127 preserve a signed signing request (Country in a DN sometimes uses
  a non-utf8 string encoding)
• remove deprecation from Validation.trust_cert_fingerprint and
  Authenticator.server_cert_fingerprint
  requested by @mben-romdhane in Why is Validation.trust_cert_fingerprint deprecated? mirleft/ocaml-x509#125, fixed in un-deprecate trust_cert_fingerprint and server_cert_fingerprint, both are valid approaches mirleft/ocaml-x509#126
• Certificate.signature_algorithm, CRL.signature_algorithm, and
  Signing_request.signature_algorithm are now provided, returning a
  ([`RSA|`ECDSA] * Nocrypto.Hash.hash) option
  requested by @psafont in Certificate verification allows dangerous algorithms mirleft/ocaml-x509#123, fixed in hash algorithms used for signatures mirleft/ocaml-x509#128

[hannesm]

CI failures are about lwt 5.0.0 not being compatible with tls -- if lwt is enabled and tests as well -- the expression conflicts: [ "lwt" {with-test & >= "5.0.0"} ] does not seem to get properly picked up by CI.

from my point of view, this PR is good to be merged.

[kit-ty-kate]

Sounds good indeed. Thanks a lot!