Keystore 2.0 SPI: Add CERTIFICATE_* tags.

Certificate subject, serial, not before and not after information is now
passed to keystore/keymint for certificate generation.
Also makeDate accepts negative time values for dates predating Jan 1970
because the CTS tests likes to generate historic certificates.

Test: Keystore CTS tests.
Change-Id: I7ce664b010222298bda8049aad48f7db155a836d