Add support for encoding/decoding basic constraints and enhanced key
usage, with tests.

- now that CertOpenStore is correct for system stores, simplify
  CertOpenSystemStore
- correct CertDuplicateCertificateStore, with a test

The behaviour for winebuild is to prefer main over WinMain, not the
other way around.

Stop using symlinks for 16-bit dlls to make sure they don't get loaded
by mistake when looking for a 32-bit dll.

We should swap min & max only when both limits are being
set. Otherwise limit that being set should invalidate other limit
(remove it).

and update comment.

- system stores open both HKLM and HKCU for "current user" locations
- fix a memory leak in certificate properties

NULL pszUnescaped is okay if URL_UNESCAPE_INPLACE is set.
Add a corresponding test for UrlUnescape{A,W}.

- Added ref counting to NSContainer.
- Better destroying of NSContainer.

behaviour.