RFR: 8296399: crlNumExtVal might be null inside X509CRLSelector::match

[Weijun Wang]

When `X509CRLSelector ` requires a CRL number extension but a CRL does not have it, the CRL should not be selected.

Note: the test uses a new internal API introduced in https://github.com/openjdk/jdk/pull/11151.

-------------

Commit messages:
 - the fix and the test

Changes: https://git.openjdk.org/jdk/pull/11215/files
 Webrev: https://webrevs.openjdk.org/?repo=jdk&pr=11215&range=00
  Issue: https://bugs.openjdk.org/browse/JDK-8296399
  Stats: 78 lines in 2 files changed: 78 ins; 0 del; 0 mod
  Patch: https://git.openjdk.org/jdk/pull/11215.diff
  Fetch: git fetch https://git.openjdk.org/jdk pull/11215/head:pull/11215

PR: https://git.openjdk.org/jdk/pull/11215