fix(x509): handle hex.DecodeString error in FormatOID() instead of discarding

[srpatcha]

Summary

Malformed hex strings in certificate subject fields could previously produce corrupt decoded output because the error from hex.DecodeString was discarded with decoded, _ := .... In a compliance ledger this is a security concern: an attacker-controlled or accidentally truncated certificate could yield bogus normalized OIDs in indexed fields.

Fix

After this fix, malformed entries are skipped and the original (unmodified) subject value remains in the output, so consumers see the raw OID rather than a silently-corrupted normalized one.

- decoded, _ := hex.DecodeString(value)
+ decoded, err := hex.DecodeString(value)
+ if err != nil {
+     continue
+ }
  subjectValues[index] = fmt.Sprintf("%s=0x%s", newKey, decoded)

Tests

Adds two test functions to x/pki/x509/x509_test.go exercising the bug:

• Test_FormatOID_HexDecodeError — 5 cases: non-hex chars, odd-length hex, embedded whitespace, mixed valid/invalid OIDs, and the positive-path regression guard
• Test_FormatOID_NoCorruptOutput — explicit assertion that vid=0x followed by empty/null bytes cannot appear in output

Both tests fail with the pre-fix code and pass with the fix applied.

Scope

Single concern, single commit, single author email.

[ashcherbakov]

• It looks like the x/audit module shouldn't be part of this PR, should it? Can you please remove it keeping only the x509 validation fix.
• It would also be great to add some tests in https://github.com/zigbee-alliance/distributed-compliance-ledger/blob/master/x/pki/x509/x509_test.go reproducing and fixing the issue.

[srpatcha]

Hi, thanks for the focused review! Both items addressed in the force-push (47e8a64):

✅ 1. Removed x/audit module

The audit module changes are now dropped from this PR. They will be submitted separately (or shelved) — keeping this PR scoped to a single concern.

✅ 2. Added regression tests in x/pki/x509/x509_test.go

Two new test functions reproduce the bug and verify the fix:

Test_FormatOID_HexDecodeError — 5 sub-tests covering the failure modes:

Input	Expectation
Non-hex chars in last 8 (#1304ZZNOTHEX)	Original entry preserved unchanged
Odd-length hex (invalid)	Original entry preserved unchanged
Whitespace-containing value	Original entry preserved unchanged
Valid hex (positive-path regression guard)	Normalizes correctly to vid=0x6006
Multiple OIDs, one valid + one invalid	Only the invalid one stays raw

Test_FormatOID_NoCorruptOutput — explicit assertion that the buggy output pattern (vid=0x followed by empty/null bytes) cannot occur. This is the security-relevant regression guard.

Both tests fail with the pre-fix code (which silently emitted truncated/empty hex) and pass with the fix applied.

📊 Final PR scope

x/pki/x509/x509.go        (+5  / -2)
x/pki/x509/x509_test.go   (+82 / -0)

One commit, one author email, ready for re-review!