Detect correct RA certificate from SCEP getca response

[mbartosch]

Currently CertNanny uses the very first certificate returned by the SCEP server getca command to encrypt the SCEP payload.
This may not be correct, in particular Windows CA does not seem to send the RA cert as first certificates.
See certnanny/sscep#39

Suggested algorithm:
If only one cert is returned, use it.
Iterate through all returned certificates. If one certificate is returned without key usage CA:true use this certificate as RA cert.
If no cert is returned without CA:true build a chain from the returned certs and use the "lowest" one (in case the CA is using a CA certificate as RA certificate.