RT3662: Allow leading . in nameConstraints

Change by SteveH from original by John Denker (in the RT)

(Imported from upstream's 77ff1f3b8bfaa348956c5096a2b829f2e767b4f1)

Confirmed by inspection of source that this matches mozilla::pkix behavior. See
https://mxr.mozilla.org/mozilla-central/source/security/pkix/lib/pkixnames.cpp#939

Change-Id: Ic4e7d011f7c10cbc83e5267550063b0ebe9648fb
Reviewed-on: https://boringssl-review.googlesource.com/2848
Reviewed-by: Adam Langley <agl@google.com>