v0.1.5 — RFC 5280 policy engine

Completes RFC 5280 §6.1 certificate policy processing, replacing the previous per-certificate required-policy subset.

What's implemented

• The valid_policy_tree with anyPolicy propagation, subtree deletion and pruning.
• Policy mapping (§6.1.4 b), including deletion when inhibitPolicyMapping is in effect.
• The explicit_policy / policy_mapping / inhibit_anyPolicy counters, with requireExplicitPolicy / inhibitPolicyMapping / inhibitAnyPolicy overrides.
• The §6.1.5 wrap-up intersection with the user-initial-policy-set.

TrustStore::require_policy(oid) now maps to initial-policy-set = {oid} + initial-explicit-policy. With no required policy the set is anyPolicy, so unconstrained chains validate exactly as before.

A new test demonstrates a case the previous subset could not: a chain mapping policy A → B with the leaf asserting B is trusted when requiring A, and rejected for an unrelated policy.

⚠️ Honest caveat

This is a from-scratch implementation of one of the most intricate, security-sensitive parts of RFC 5280. It is exercised by the crate's hand-built scenario tests but has not been validated against the NIST PKITS suite. Review it before relying on policy decisions for high-stakes use.

With this, the only roadmap item left is richer visible appearances (embedded fonts/images).