apps: cover the -crlexts option in the ca recipe

Generate a CRL taking its extensions from a dedicated section of
the configuration file and check that the CRL is version 2 and
carries the requested extension.

Assisted-by: Claude:claude-fable-5
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Merge-date: Mon Sep  7 18:11:17 2026
Merged-from: https://github.com/openssl/openssl/pull/32632