Complete the ISO 9796-2 decoding

In particular:

• use the full CAR for identifying (sub)CA certs
• support (sub)CA in ISO 9796-2 formats, not just raw ones
• decode signed (sub)CA certificates before using them
• decode the ticket data, now that we have the decoded CV cert key