tasks: Mark OpenSSL basicConstraints extension as critical

This is a requirement with OpenSSL 3, otherwise it rejects our generated
certificates:

> ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED]
> certificate verify failed: Basic Constraints of CA cert not marked
> critical (_ssl.c:1020)

tasks/credentials/openssl.cnf

@@ -25,7 +25,7 @@ organizationalUnitName = optional
 domainComponent = optional
 
 [ certificate_extensions ]
-basicConstraints = CA:false
+basicConstraints = critical, CA:false
 
 [ req ]
 default_bits = 2048
@@ -39,16 +39,16 @@ x509_extensions = root_ca_extensions
 commonName = hostname
 
 [ root_ca_extensions ]
-basicConstraints = CA:true
+basicConstraints = critical, CA:true
 keyUsage = keyCertSign, cRLSign
 
 [ client_ca_extensions ]
-basicConstraints = CA:false
+basicConstraints = critical, CA:false
 keyUsage = digitalSignature,keyEncipherment
 extendedKeyUsage = 1.3.6.1.5.5.7.3.2
 
 [ server_ca_extensions ]
-basicConstraints = CA:false
+basicConstraints = critical, CA:false
 keyUsage = digitalSignature,keyEncipherment
 extendedKeyUsage = 1.3.6.1.5.5.7.3.1
 subjectAltName=DNS:*.apps.ocp.ci.centos.org,DNS:*.cockpit-project.org,DNS:cockpit-tests,DNS:cockpituous,DNS:*.compute-1.amazonaws.com,DNS:localhost,DNS:localhost.localdomain