2.9 (2024.06.29)

• added a 64 bit long pseudo-random NONCE in the TSA request
• missing NID_pkcs9_signingTime is no longer an error
• added support for PEM-encoded CRLs
• fixed the APPX central directory sorting order
• added a special "-" file name to read the passphrase from stdin
  (by Steve McIntyre)
• used native HTTP client with OpenSSL 3.x, removing libcurl dependency
• added '-login' option to force a login to PKCS11 engines
  (by Brad Hughes)
• added the "-ignore-crl" option to disable fetching and verifying
  CRL Distribution Points
• changed error output to stderr instead of stdout
• various testing framework improvements
• various memory corruption fixes