Rewrite the path builder

The old path builder was a mess. It would collect certificates until it
hit a self-signed certificate, or failed, and then it would go back and
check after the fact if it found a trust anchor.

This meant that, in a variety of edge cases, the path would extend
beyond the trust anchor. Rework all this to match how X.509 is actually
meant to work. We append to the chain, evaluating trust in the
newly-appended certificate. If it's a trust anchor, we stop.

Maintain the invariant from before where we will always append untrusted
certificates, followed by store certificates, and not interleave them.
(Otherwise last_untrusted is broken. We also should remove the
last_untrusted variable, but that's a separate bug.)

This is still not a backtracking path-builder, but at least it doesn't
give incoherent answers.

In doing so, the function evaluating whether we have a trust anchor is
cleaned up. This fixes some of the weird cases around the target
certificate being in the trust store. (See updated unit tests.)

Update-Note: X509_verify_cert is reworked to have many downright buggy
behaviors fixed. In particular, it will now stop building the path at a
trust anchor. This matches modern OpenSSL behavior and how X.509 is
meant to work. We've also qualified this against tests at Google. But if
something breaks around certificate verification, let us know.

Fixed: 548461146
Change-Id: I1b963f034d6b778d218bc736b1a2dc3e6bed4fa0
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/103863
Reviewed-by: Lily Chen <chlily@google.com>
Commit-Queue: David Benjamin <davidben@google.com>