feat: add CRL-based certificate revocation checking

[catay]

Add certificate revocation checking via CRL (Certificate Revocation List).

Changes

• New internal/revocation/ package with CRL fetch, parse, signature verification, and serial number lookup
• --revocation, --revocation-timeout, --revocation-soft-fail flags on both client and pem subcommands
• Revocation status displayed in human-readable and verbose text output (colored labels)
• JSON/YAML output includes revocation field with per-method results
• Captures stapled OCSP bytes from TLS handshake (plumbing for future OCSP support)
• Comprehensive tests for CRL checking (good/revoked/stale/error/no-endpoints)

Usage

tlsctl client --revocation=crl example.com
tlsctl pem --revocation=crl cert.pem