Investigate allowing OID_ANY_EKU for certificate verification policies

[complexspaces]

Chromium allows this OID in their Android verifier, so we should investigate if its correct for us to add it addition to the existing server auth EKU. They also check for it and test against it in their verifier.

Additionally, we should take this chance to try and document/verify which EKUs are enforced on what platforms and hopefully make them uniform as reasonable.