limbo: add duplicate_extensions test

[woodruffw]

This adds a new basic namespace, along with a duplicate_extensions testcase that ensures that implementations reject certificates with duplicated extensions.

[facutuesca]

This could go in the rfc5280.py file, since it's defined in that doc. Docstring for the test:

    """
    Produces the following **invalid** chain:

    ```
    root -> EE
    ```

    The EE cert contains a duplicated extension, which is
    forbidden under the [RFC 5280 profile].

    > A certificate MUST NOT include more than one instance of a particular
    > extension.

    [RFC 5280 profile]: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2
    """

[woodruffw]

Yeah, this is debatable: RFC 5280 includes it as a matter of course, but it's also a "baseline" property of X.509v3:

EXTENSION ::= CLASS {
 &id OBJECT IDENTIFIER UNIQUE,
 &ExtnType }
WITH SYNTAX {
 SYNTAX &ExtnType
 IDENTIFIED BY &id }

(From https://www.itu.int/rec/T-REC-X.509-201910-I/en, page 17)

[woodruffw]

TL;DR I'm okay with it being in rfc5280.py since it's also specified there 🙂

[facutuesca]

I think we should leave extra_extension as it is (it adds extensions using the "official" Builder.add_extension API), and add a new param (something like extra_unchecked_extensions) that bypasses validation:

        extra_extension: _Extension | None = None,
        extra_unchecked_extensions: list[_Extension] | None = None,
        # ...
        if extra_unchecked_extensions is not None:
            for e in extra_unchecked_extensions:
                builder._extensions.append(
                x509.Extension(
                    e.oid, e.critical, e.ext
                )
            )

My reasoning is that the intent will be clearer for whoever reads the tests ("oh, this test depends on creating a certificate that can't be created using the normal API"), and it's also useful for writing the tests, since most of the time you do want these checks enabled.

[woodruffw]

Yeah, this is a good idea. Longer term I'd like to turn extra_extension into extra_extensions as well, but that can be entirely separate.

[woodruffw]

LGTM, thanks @facutuesca!