Add SPIFFE ID extraction to CertificateAuthority

[ctyano]

According to the implementation, the supported format of SPIFFE ID in Athenz should be:

        // spiffe://[<provider-cluster>/ns/]<athenz-domain>/sa/<athenz-service>
        // spiffe://[<provider-cluster>/ns/]<athenz-domain>/ra/<athenz-role>

Also for the general cases of retrieving certificates, CLI tools already support including SPIFFE ID in CSR.
https://github.com/yahoo/athenz/blob/eb0a7064ced6d0386a9e2c61ee142a413f5a8388/utils/zts-rolecert/zts-rolecert.go#L76
https://github.com/yahoo/athenz/blob/6af7ec1dc842247351c5134aa378bce291718c74/utils/zts-svccert/zts-svccert.go#L92

However, there is no reference implementation for validation.
Is it possible to add a step in CertificateAuthorityto extract a principal name from SPIFFE ID?