Add x509.CustomExtensionType for user-defined extension types

[alex]

Refs #15500.

Adds x509.CustomExtensionType, a base class for defining X.509 extension types that cryptography does not natively support, using cryptography.hazmat.asn1 types for their values:

@asn1.sequence
class Point:
    x: int
    y: int

class PointExtension(x509.CustomExtensionType[Point]):
    oid = x509.ObjectIdentifier("1.2.3.4")

ext = cert.extensions.get_extension_for_class(PointExtension)
ext.value.value.x

builder = builder.add_extension(PointExtension(Point(x=1, y=2)), critical=False)

• Extensions.get_extension_for_class accepts CustomExtensionType subclasses. When the matching extension is present as an UnrecognizedExtension, its DER value is decoded into the custom class and returned as a new Extension. The value is typed end to end: mypy sees ext.value.value as Point.
• Subclasses must be parameterized with a concrete ASN.1 type and define oid; both are validated at class-definition time.
• Instances can be passed to the certificate, CRL, CSR, and OCSP builders. The shared Rust encode_extensions path calls public_bytes() for them, which encodes with asn1.encode_der.

Of the two shapes discussed on the issue, the alias form CustomExtensionType[T, ExtensionOID.X] is not feasible: type checkers reject a value as a type argument, and the runtime object is a typing._GenericAlias rather than a class. The subclass form is implemented here.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Xp766iEvYJexKJZRx3Rm4v

---

Generated by Claude Code