Validate `critical` OID extensions

[asgrim]

Some OID extensions can be labelled critical and these must be validated.

Investigate what (if any) critical OID extensions are typically expected, and add support for them.