Add more hxtool EKU options, and KeyUsage too

This is necessary in order to have more control over, e.g., template
certificates for kx509.  But also it's good to have this more generally.

Some batteries not included.  Specifically: no attempt is made to validate that
given KeyUsage values are compatible with the subjectPublicKey's alrogithm and
parameters.

lib/hx509/hxtool-commands.in

@@ -426,6 +426,12 @@ command = {
 		type = "string"
 		help = "Subject DN"
 	}
+	option = {
+		long = "eku"
+		type = "strings"
+		argument = "oid-string"
+		help = "Add Extended Key Usage OID"
+	}
 	option = {
 		long = "email"
 		type = "strings"
@@ -650,6 +656,17 @@ command = {
 		type = "integer"
 		help = "Maximum path length (CA and proxy certificates), -1 no limit"
 	}
+	option = {
+		long = "eku"
+		type = "strings"
+		argument = "oid-string"
+		help = "Add Extended Key Usage OID"
+	}
+	option = {
+		long = "ku"
+		type = "strings"
+		help = "Key Usage (digitalSignature, keyEncipherment, dataEncipherment, keyAgreement, keyCertSign, cRLSign, encipherOnly, decipherOnly)"
+	}
 	option = {
 		long = "hostname"
 		type = "strings"