docs: document certificate parser strictness model

[leopoldjoy]

Summary

• document the certificate parser hardening model and accepted-subset invariants
• explain why non-canonical encodings should stay rejected even after the TBS cache-key fix
• call out the parser-disagreement risk these hardening checks are meant to avoid

Security value

This gives reviewers and future maintainers a clear invariant to preserve so future parser changes do not accidentally re-open non-DER certificate acceptance surfaces.

Tests

• git diff main...HEAD --check

Note

Latest main already fails test_DeployableContractsFitEIP170 locally with CertManager runtime bytes 24,708 > 24,576; this docs-only PR does not affect bytecode size.