Fenrir fixes

[JeremiahM37]

Fixes F-2937, F-2938, F-2939, F-2940, F-2941, F-2942, F-2943.

• Null-check jstring params before GetStringUTFChars in X509_add_altname, X509_add_ext_via_nconf_nid (Cert and Req), and X509_is_extension_set
• Null-check fileBytes/keyBytes/digestAlg params before Get calls in X509_sign and X509_REQ_sign
• Null-check fileBytes param in X509_set_pubkey_native_open
• Null-check serialBytes param in X509_set_serialNumber
• Null-check fileBytes param in X509_REQ_set_pubkey_native_open
• Add missing return after exception handling in NativeRsaSignCb to prevent JNI local ref double-free
• Free internCtx on NewGlobalRef failure in seven PK callback context setup functions

No unit tests added since these mostly just defensive hardening.