F7859: wolfx509: honor BasicConstraintsValid and mark it critical

[lealem47]

Fix for F7859

And adding a testing matrix that validates BasicConstraintsValid and IsCA permutations

[Copilot]

Pull request overview

Updates wolfx509 certificate generation to align BasicConstraints behavior with crypto/x509: only emit BasicConstraints when BasicConstraintsValid is set, and mark the emitted extension as critical, with tests covering BasicConstraintsValid/IsCA permutations.

Changes:

• Forward Certificate.BasicConstraintsValid into the internal cert build options.
• Gate CA/basic constraints encoding on BasicConstraintsValid, and ensure the BasicConstraints extension is marked critical when emitted.
• Add a BasicConstraints test matrix validating presence, criticality, and encoded value across flag permutations.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
wolfx509/certgen.go	Propagates BasicConstraintsValid from the template into cert build options.
wolfx509/certgen_wolfcrypt.go	Updates wolfCrypt-backed cert generation to honor BasicConstraintsValid and force critical BasicConstraints when emitted.
wolfx509/certgen_test.go	Adds a test matrix pinning BasicConstraints presence/criticality/value for BasicConstraintsValid + IsCA combinations.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.