ssl: fix critical extension handling regression

[askourtis]

Description

Parsing the peer certificate did not consider critical extensions and would fail by default. Using mbedtls_x509_crt_parse_der_with_ext_cb to parse the peer certificate fixes this issue.

Users can use mbedtls_ssl_set_ext_cb and mbedtls_ssl_conf_ext_cb to provide a callback and a context for handling said extensions.

Fixes #7182

PR checklist

Please tick as appropriate and edit the reasons (e.g.: "backport: not needed because this is a new feature")

• changelog provided, or not required
• backport done, or not required
• tests provided, or not required

Notes for the submitter

Please refer to the contributing guidelines, especially the
checklist for PR contributors.

[askourtis]

Did not offer tests since the change is minor, I've set up manually an HTTP server and tested that critical extensions were handled by the callback. Please tell me if the tests are necessary, for the PR to be merged.

[valeriosetti]

Did not offer tests since the change is minor,

I'm not an expert in X.509, but I took a look at the PR and it looks OK to me. As far as I know it would be better to test each new feature with some test, so I would add it also to this one, but this is only my opinion. Let's see what other reviewers think about it before trying to implement one.