Complete the ISO 9796-2 decoding

In particular:
- use the full CAR for identifying (sub)CA certs
- support (sub)CA in ISO 9796-2 formats, not just raw ones
- decode signed (sub)CA certificates before using them
- decode the ticket data, now that we have the decoded CV cert key