Fixes for CRL callback docs, session SNI copy, cert stack checks, CRL serial test

[cconlon]

This PR includes five Fenrir fixes:

• F-12699: Document missing CRL callback setters keep one process-wide callback per level
• F-3911: Copy stored SNI server names in the WolfSSLImplementSSLSession copy constructor
• F-4148: Null-check the certificate stack before counting it in getDerCerts, and free it when empty.
• F-6305: Free the popped extension object and remaining stack on the pre-4.2.0 path of X509_get_extension.
• F-9122: Add a CRL test that decodes the generated CRL and asserts the revoked serial matches the raw input bytes.

[Copilot]

🟡 Changes recommended

There are a few correctness gaps in the new test coverage and a potential NULL-free risk in the native extension cleanup that should be addressed before approval.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR applies a set of targeted fixes across the wolfSSL JNI/JSSE layers: clarifying CRL callback behavior, correcting SSLSession copy semantics for SNI, tightening native memory/NULL handling around certificate stacks and extension retrieval, and adding regression tests for CRL serial handling.

Changes:

• Document that missing-CRL callbacks are process-wide per registration level (session vs context) due to native callback limitations.
• Preserve stored SNI server names when copying WolfSSLImplementSSLSession.
• Harden native JNI paths for certificate stack handling and extension retrieval cleanup, and add a CRL revoked-serial decode test.

File summaries

File	Description
src/test/com/wolfssl/test/WolfSSLCRLTest.java	Adds a CRL serial decode/round-trip regression test.
src/test/com/wolfssl/provider/jsse/test/WolfSSLSessionTest.java	Adds a regression test ensuring the SSLSession copy constructor preserves SNI server names.
src/java/com/wolfssl/WolfSSLSession.java	Expands Javadoc to clarify missing-CRL callback registration scope/behavior.
src/java/com/wolfssl/WolfSSLContext.java	Expands Javadoc to clarify missing-CRL callback registration scope/behavior.
src/java/com/wolfssl/provider/jsse/WolfSSLImplementSSLSession.java	Copies stored SNI server names in the session copy constructor.
native/com_wolfssl_WolfSSLX509StoreCtx.c	Adds NULL/empty-stack handling for certificate-stack retrieval in getDerCerts.
native/com_wolfssl_WolfSSLCertificate.c	Improves JNI error handling and frees extension objects/stacks on the pre-4.2.0 path.

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.