fix: reject ambiguous cert field consumption

[leopoldjoy]

Summary

• require parsed TBS fields to stay within and end at the signed TBS boundary
• require extension objects to consume exactly their declared field set, without trailing ignored fields
• reject duplicate known security extensions such as basicConstraints and keyUsage

Security value

This prevents signed-but-ignored fields and duplicate semantic extensions from creating parser disagreement with stricter X.509 validators.

Tests

• forge fmt --check src test
• forge test --match-test 'test_ExtensionsReject.*|test_ParseTbsRejectsTrailingSignedFields|test_VerifyCACertWithHints_ShortS_Regression' -vvv

Note

Latest main already fails test_DeployableContractsFitEIP170 locally with CertManager runtime bytes 24,708 > 24,576, so full-suite verification remains blocked by that pre-existing size issue.