fix: reject unknown critical cert extensions

[leanthebean]

Summary

Fixes CAT finding 7895879c-27dc-4910-be03-948111c824cc.

CertManager._verifyExtensions previously only parsed the critical flag for the two supported extension OIDs, BasicConstraints and KeyUsage. Unknown extension OIDs were skipped without checking whether the extension was marked critical, which is not compliant with RFC 5280 path validation behavior.

This change:

• parses the optional critical BOOLEAN before dispatching on the extension OID;
• continues to process BasicConstraints and KeyUsage as before;
• allows unknown non-critical extensions;
• rejects unknown critical extensions with unsupported critical extension.

Self Review

Reviewed the final diff before opening this PR. The production change is scoped to the extension loop in _verifyExtensions; valid AWS Nitro critical BasicConstraints/KeyUsage handling is unchanged, unknown non-critical extensions remain forward-compatible, and only unrecognized critical=TRUE extensions now fail closed.

Tests

• forge test --match-path test/CertManager.t.sol -vvv
• forge test