reject signing certificates not marked for code signing

[Support-itecz]

Summary

_verify_certificates decides a signing certificate is usable when it has the digitalSignature key usage bit or a code-signing extended key usage, treating the two as alternatives. An extended key usage is restrictive when present (RFC 5280 4.2.1.12), so a certificate whose only EKU is serverAuth (an ordinary TLS certificate) is still accepted as long as digitalSignature is set. Because the default trust roots are the certifi bundle, any holder of a publicly trusted TLS certificate can produce a signature this verifier accepts.

The fix rejects a certificate whose extended key usage lists neither code signing nor anyExtendedKeyUsage, even when the key usage bit is set. Keeping the check inside the verifier covers every certificate-based verification path without callers validating the chain themselves. Added a regression test that mints a serverAuth-only leaf under a private root and confirms it is now rejected, along with positive cases for a code-signing leaf and a leaf with no EKU.

To reproduce before the fix: build a leaf with ExtendedKeyUsage([serverAuth]) and KeyUsage(digital_signature=True) chaining to a root in the verifier's store, then verify a signature made with its key. Verification passes.

Checklist

• All commits are signed-off, using DCO
• All new code has docstrings and type annotations
• All new code is covered by tests. Aim for at least 90% coverage. CI is configured to highlight lines not covered by tests.
• Public facing changes are paired with documentation changes
• Release note has been added to CHANGELOG.md if needed

[mihaimaruseac]

This looks good, but I will want to run some tests against existing signed models, to make sure they can still be verified.

Meanwhile, can you solve the conflicts please?

[Support-itecz]

Conflicts resolved, rebased onto main. Main picked up its own tests/_signing/certificate_test.py from #649, so I folded the EKU tests into that file instead of keeping two copies; full suite passes locally (203 tests).

On the compatibility testing: certs with a codeSigning EKU or with no EKU at all still verify unchanged. The only signatures newly rejected are ones whose cert carries an EKU listing neither codeSigning nor anyExtendedKeyUsage, which is the case the fix targets.

[Support-itecz]

Conflicts resolved. Rebased on main and folded my EKU tests into the new tests/_signing/certificate_test.py alongside the SAN pinning ones; full unit suite passes (200). On testing against existing signed models: certificates with no EKU at all are still accepted, only an EKU listing neither codeSigning nor anyExtendedKeyUsage is rejected, and Fulcio-issued leaves carry codeSigning, so already-signed models should verify unchanged.