Change x509_get_aki(), x509_get_ski(), x509_get_aia(), and x509_get_crl()

Change x509_get_aki(), x509_get_ski(), x509_get_aia(), and x509_get_crl()
to work more like x509_get_expire(). They will return an error if the
extension extraction failed but not if it was not present. The callers
must now do that check but most did already.
With this cert_parse_inner() no longer cares about TA vs non-TA certs.
Feedback and OK tb@