* fix parsing for CRLs with TLVs > 65535 bytes (#7575)

* add CRL test vector with 9,999 revoked items

* bump rust-asn1

* add large CRL test

this tests CRLs larger than 65535 bytes in size. rust-asn1 supports up
to 4GiB TLVs now, but we'll avoid putting a test vector that big for now

* changelog and 38.0.1 bump

* Add `tbs_precertificate_bytes` property

* docs/x509: document `tbs_precertificate_bytes`

Signed-off-by: William Woodruff <william@trailofbits.com>

* tests/x509: add two trivial tests

Signed-off-by: William Woodruff <william@trailofbits.com>

* x509/base: fix lint

Signed-off-by: William Woodruff <william@trailofbits.com>

* oid: add CERTIFICATE_TRANSPARENCY (1.3.6.1.4.1.11129.2.4.4)

Signed-off-by: William Woodruff <william@trailofbits.com>

* hazmat/oid: rehome CERTIFICATE_TRANSPARENCY under ExtendedKeyUsageOID

Signed-off-by: William Woodruff <william@trailofbits.com>

* docs/x509: fix link, help the spellchecker

Signed-off-by: William Woodruff <william@trailofbits.com>

* x509: Raise ValueError when we can't filter SCT list extension

* tests: Expect a `ValueError` when accessing `tbs_precertificate_bytes`
in default example

* tests, vectors: Add TBS precert vector for test comparison

* docs/x509: document the `CERTIFICATE_TRANSPARENCY` OID

Signed-off-by: William Woodruff <william@trailofbits.com>

* docs/x509: elaborate `tbs_precertificate_bytes`

Signed-off-by: William Woodruff <william@trailofbits.com>

* rust/x509: remove unused OID

Signed-off-by: William Woodruff <william@trailofbits.com>

* x509/certificate: tweak error

Signed-off-by: William Woodruff <william@trailofbits.com>

* tests/x509: reorganize

Signed-off-by: William Woodruff <william@trailofbits.com>

* Update src/rust/src/x509/certificate.rs

Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com>

* tests/x509: more reorg, rename

Signed-off-by: William Woodruff <william@trailofbits.com>

* docs: document new testvector

Signed-off-by: William Woodruff <william@trailofbits.com>

* docs: coax the spellchecker

Signed-off-by: William Woodruff <william@trailofbits.com>

* tests/x509: use a cert that doesn't require SHA-1

Signed-off-by: William Woodruff <william@trailofbits.com>

* tests/x509: test for no extensions at all

Signed-off-by: William Woodruff <william@trailofbits.com>

Co-authored-by: Alex Cameron <asc@tetsuo.sh>
Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com>

* Added vectors for invalid CSR/CRL versions

* Update docs/development/test-vectors.rst

Co-authored-by: Paul Kehrer <paul.l.kehrer@gmail.com>

Co-authored-by: Paul Kehrer <paul.l.kehrer@gmail.com>

We don't use it since 1eccc52b637a4745a38e61ca2f9f21d383862175

Signed-off-by: William Woodruff <william@yossarian.net>

CRL versions only go up to v2 (numeric value 1) and CSRs only define v1
(numeric value 0). See
https://www.rfc-editor.org/rfc/rfc5280.html#section-5.1 and
https://www.rfc-editor.org/rfc/rfc2986.html#section-4. Some of the
inputs used in tests were misissued.

Unfortunately, the corresponding private keys for these test vectors
weren't provided, so I've just editted the inputs with der-ascii and
left the signatures invalid. The tests in question don't seem to rely on
valid signatures.

* add x509 pss certificate and public key

the cert is signed using rsa_pss_2048.pem and the public key is the
public components of that private key

* Update docs/development/test-vectors.rst

Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com>

Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com>