crypto/x509: CANotAuthorizedForExtKeyUsage is a bogus error [1.10 backport]

[gopherbot]

@FiloSottile requested issue #24590 to be considered for backport to the next 1.10 minor release.

Based on discussion with @agl, we will go back to only enforcing nesting (and returning CANotAuthorizedForExtKeyUsage) when the EKU is being asserted in Verify.

@gopherbot, please open a tracking issue for backporting to 1.10.

[gopherbot]

Change https://golang.org/cl/114035 mentions this issue: [release-branch.go1.10] crypto/x509: check EKUs like 1.9.

[gopherbot]

Closed by merging 09fa131 to release-branch.go1.10.