ASN1BitString.encode() doesn't guarantee that unused bits are 0

[kdeus]

The standard requires unused bits to be set to 0, so there's only one possible encoding. I don't see anything in ASN1BitString.encode() that guarantees that, if the caller used the ByteArray constructor directly.

Either add a check()/require() or force those values to 0 before appending?

[kdeus]

And we should have a unit test covering this case...