test_external_ca: switch to python-cryptography
    
    Switch external CA generation from certutil to python-cryptography
    as this way of handling the certificates should be more readable,
    maintainable and extendable (e.g. extensions handling).
    
    Also as external CA is now a separate module we can import it and
    use elsewhere.
    
    https://pagure.io/freeipa/issue/7154
    
    Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
    Reviewed-By: Christian Heimes <cheimes@redhat.com>