Add SubjectPublicKeyID.

[jsha]

I added it only for roots, where it's a MUST. For end-entity certificates, RFC 5280 says:

For end entity certificates, the subject key identifier extension
provides a means for identifying certificates containing the
particular public key used in an application. Where an end entity
has obtained multiple certificates, especially from multiple CAs, the
subject key identifier provides a means to quickly identify the set
of certificates containing a particular public key. To assist
applications in identifying the appropriate end entity certificate,
this extension SHOULD be included in all end entity certificates.

Since the purpose in EE certificates appears to be identifying certificates that
share a common key, and minica EE certificates will never share a common key,
it seems fine to omit. I could be convinced otherwise, though.

Fixes #21.

@FiloSottile, thanks for the report. Would you review?