crypto/x509: EKU nesting enforcement broken at tip

[rolandshoemaker]

Path rebuilding broke EKU nesting, this was never included in a release, so just needs to be fixed before 1.19.

[gopherbot]

Change https://go.dev/cl/403554 mentions this issue: crypto/x509: fix EKU nesting enforcement