crypto/x509: excluded subdomain constraint doesn't preclude wildcard SAN (CVE-2025-61727) [1.25 backport]

[gopherbot]

@rolandshoemaker requested issue #76442 to be considered for backport to the next 1.25 minor release.

@gopherbot please open backport issues, this is a minor security bug.

[gopherbot]

Change https://go.dev/cl/724400 mentions this issue: [release-branch.go1.25] crypto/x509: excluded subdomain constraints preclude wildcard SANs

[gopherbot]

Closed by merging CL 724400 (commit 287017a) to release-branch.go1.25.