crypto/x509: single-label excluded DNS name constraints incorrectly match all wildcard SANs [1.24 backport]

[gopherbot]

@rolandshoemaker requested issue #76935 to be considered for backport to the next 1.24 minor release.

@gopherbot please open backport issues.

[gopherbot]

Change https://go.dev/cl/739420 mentions this issue: crypto/x509: fix single label excluded name constraints handling

[gopherbot]

Closed by merging CL 739420 (commit 2c4733c) to release-branch.go1.24.