fix: pem parsing detection of last cert errors

[lrstewart]

Release Summary:

Fixed a bug in certificate pem parsing. We now correctly reject certificate chains where the last certificate is unexpectedly significantly truncated (for example, missing the final "-- END CERTIFICATE --" marker).

Resolved issues:

resolves #4788

Description of changes:

Before, certificate parsing ignored errors unless there was unread data left in the stuffer after the failure. That meant any error due to missing data in the last certificate was ignored. My new tests are a good visual representation of what errors were previously ignored.

I modified the parsing logic to require that certificate parsing always succeed. Instead of attempting to parse the next certificate and then deciding how to handle any failures, we now first check for the delimiter characters ("--") and assert that parsing will succeed if the characters are present. If the characters aren't present, then there are no more certificates in the pem file (although there might be whitespace / comments / other garbage, but we also skipped over those before). Basically, we now treat any error that occurs after we find the delimiter characters as a real error, regardless of the state of the stuffer or chain.

The pem parsing code is also used for CRLs, private keys, and DH params, but all those parsing methods assume only one certificate in the pem and treat all errors as failures (although private key parsing does act on those errors).

Call-outs:

I also cleaned up memory management in the parsing method using DEFER_CLEANUP. It makes the diff harder to read, but it's not a large diff. But let me know if the diff is too hard to read and I should move the memory cleanup to another PR.

Testing:

• I added several new positive parsing cases, which pass both before and after my change.
• I added several new negative parsing cases, which failed before my change but pass after.
• I also added a version of the negative parsing test that re-runs all the negative cases, but for a certificate at the end of a longer certificate list. That way we make sure that any errors we add to the negative cases aren't just being caught by our "chain_size > 0" check, like they were before.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.