Fixes #1165.

- Add usernames for Oren Yomtov, Youngjoon Kim, Brian Lee, and
  @EchoSkorJjj (previously credited as SongWriterOP GT).
- Add Brian Lee to the BIT STRING maxDepth credits.

- [ed25519] Reject small-order public keys in `ed25519.verify()`. Under
  such a key, signatures with `S = 0` and a small-order `R` verified for
  many or all messages without a private key.
- Address GHSA-6889-vf6x-f3g5:
  - GHSA-6889-vf6x-f3g5
- Add submitted PoC.
- Add tests.

Parse the id-ce-nameConstraints (2.5.29.30) extension into
`permittedSubtrees` and `excludedSubtrees` and check the subject DN,
subject emailAddress attributes and subjectAltName entries of each
certificate (except self-issued intermediates) against the constraints
of every certificate above it in the chain and of the trust anchor
(RFC 5280 4.2.1.10, 6.1.3 (b) and (c), 6.1.4 (g)). Supported name types
are rfc822Name, dNSName, directoryName, uniformResourceIdentifier and
iPAddress. Constraints that cannot be evaluated fail closed with
`unsupported_certificate`. A critical nameConstraints extension is no
longer rejected as unsupported.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Changes on top of the submitted fix, checked against `openssl verify`
(OpenSSL 3.5.5) on 62 curated chains and 2600 random constraint and
name combinations, with no differences:

- [x509] Check the commonName values of an end-entity certificate
  without a dNSName subjectAltName as dNSNames when they look like host
  names (OpenSSL `NAME_CONSTRAINTS_check_CN()`, `cn2dnsid()`). The
  submitted PoC leaf has only `CN=evil.com` and still verified.
- [x509] Limit checking to 2^20 name and subtree comparisons per chain
  and fail with `unsupported_certificate` above it (OpenSSL limits
  names * subtrees to 2^20, `NAME_CHECK_MAX`). Names are checked before
  the CA above them is known to be trusted, and a self-made CA with 16000
  excluded subtrees and a leaf with 16000 subjectAltNames (850 KB of PEM)
  blocked verification for 58 seconds. Collect the constraints for the
  chain in one list instead of copying them for each certificate, and
  lowercase and canonicalize names and subtrees once instead of on every
  comparison.
- [x509] Don't throw while parsing a certificate with an invalid
  nameConstraints value; leave it unparsed. Chain verification always
  parses the value again and fails with `unsupported_certificate`.
- [x509] Apply subtrees only to names of the same type (RFC 5280
  4.2.1.10). An unsupported subtree, such as an otherName or one with a
  maximum, rejected every certificate below it, including TLS
  certificates under an AD CS "qualified subordination" CA that permits
  otherName UPNs and dNSNames.
- [x509] Compare directoryName values ignoring ASCII case and extra
  whitespace (RFC 5280 7.1). `O=example` was not within `O=Example`, and
  `O=EVIL` was not within an excluded `O=Evil`.
- [x509] Match an rfc822Name subtree `@host` against every mailbox on
  the host. It only matched an empty local part, so an excluded
  `@evil.com` excluded nothing.
- [x509] Fail with `unsupported_certificate` for an rfc822Name without
  `@` or a URI without a host when there is a subtree of that type. They
  were accepted under excluded subtrees.
- [x509] Check the names in every subjectAltName extension.
- [x509] Rename the violation error's `name` property to `nameValue`.
- Address GHSA-3cc4-3294-vgjf:
  - GHSA-3cc4-3294-vgjf
- Add submitted PoC.
- Add tests.
- Document what `verifyCertificateChain()` checks.

- [tls] Ignore handshake messages received by a client without a
  session (before `handshake()`, or after `close_notify` or `close()`)
  instead of throwing a `TypeError` from `process()`.
- Address GHSA-j8rw-jp99-435v:
  - GHSA-j8rw-jp99-435v
- Add submitted PoC.
- Add tests.

- [http] Trim header and cookie values with a loop instead of `/\s*$/`,
  which is quadratic on a long run of whitespace followed by another
  character.
- Address GHSA-6cv4-p8m7-4r25:
  - GHSA-6cv4-p8m7-4r25
- Add tests.

- [tls] Fail a client handshake with an `illegal_parameter` alert when
  the ServerHello selects a compression method other than none, instead
  of throwing an uncaught `Error` at ServerHelloDone.
- Address GHSA-w4xr-hqv8-ch44:
  - GHSA-w4xr-hqv8-ch44
- Add submitted PoC.
- Add tests.