Excluded iPAddress name constraints with an all-zero mask are not applied

Name constraints for URI names were incorrectly accepted

Name constraints were accepted for certificates asserting a wildcard name

AWS-LC X.509 Name Constraints Bypass via Wildcard/Unicode CN