Set presence of AIA extension to SHOULD for Subscriber Certificates

[srdavidson]

The AIA extension should be SHOULD instead of MUST for subscriber certificates. This is because the permissible accessMethods are both optional. (id-ad-caIssuers is a SHOULD, and id-ad-ocsp is a MAY.) Thus, it seems reasonable to make AIA a SHOULD as well, since no RP can depend on a particular accessMethod being present regardless.

See https://github.com/cabforum/servercert/pull/665/changes from @e3n0

[github-actions]

This issue was created based on:

• TLS BR Version 2.2.8
• EVG Version 2.0.3

[aarongable]

For historical context, we got into this state because it used to be the case that id-ad-ocsp was a MUST. Ballot SC-063 (#441), which made OCSP optional, changed id-ad-ocsp to MAY, but didn't change the requirements around the AIA extension as a whole.