crypto/x509: reject unsupported bounds in critical name constraints #81499

In src/crypto/x509/parser.go, parseNameConstraintsExtension reads a GeneralSubtree SEQUENCE and its first element but does not consume or check the remaining seq. processExtensions then considers the extension handled, and chain constraint checks operate only on the parsed base names.

A reproducer uses an Ed25519 root, intermediate, and leaf, with this critical nameConstraints extension (OID 2.5.29.30) on the intermediate:

// permittedSubtrees: dNSName "example.com", maximum [1] 0
badNC := []byte{0x30, 0x14, 0xa0, 0x12, 0x30, 0x10, 0x82, 0x0b,
    'e', 'x', 'a', 'm', 'p', 'l', 'e', '.', 'c', 'o', 'm', 0x81, 0x01, 0x00}

Give the leaf the DNS SAN www.example.com, trust the root, supply the intermediate, and call leaf.Verify with that DNS name and a time within all certificates' validity intervals. UnhandledCriticalExtensions is empty and verification returns nil, despite the unsupported maximum bound.

RFC 5280 §4.2.1.10 requires minimum zero and maximum absent within the profile. For a critical extension with other bounds on a name form used later in the path, an implementation must process the bounds or reject the certificate.