Deprecate --ns-cert-type

Deprecate --ns-cert-type

This is a manual cherry-pick of commit 2dc33226 of the master branch,
for the release/2.3 branch.

The nsCertType x509 extension is very old, and barely used.  We already
have had an alternative for a long time: --remote-cert-tls uses the far
more common keyUsage and extendedKeyUsage extensions instead.

OpenSSL 1.1 no longer exposes an API to (separately) check the nsCertType
x509 extension.  Since we want be able to migrate to OpenSSL 1.1, we
should deprecate this option immediately.

Trac: #876

Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: David Sommerseth <davids@openvpn.net>
Message-Id: <1502222447-8186-1-git-send-email-steffan@karger.me>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15180.html
Signed-off-by: David Sommerseth <davids@openvpn.net>