crypto/x509: check Certificate.isValid on CertPool.Add

[rolandshoemaker]

We shouldn't be adding certificates to the pool which we cannot reasonably later use during chain building. CertPool.Add doesn't have an error return, so we should just silently discard the certificate when isValid returns a non-nil error.

[rittneje]

Would that not be a breaking change wrt CertPool.Subjects?

[rolandshoemaker]

I see there is a behavioral change here (i.e. Subjects will return the subject of a cert, but will likely not actually use it during chain building), but I don't really see how its breaking? (also side note, CertPool.Subjects is already deprecated, further changing its behavior seems fine).

[rittneje]

If I call AddCert with such an invalid certificate, will Subjects still report it? If not I think it could be a breaking change.