Add final support for "name constraints". 35 tests from NIST PKITS 2011 were passed, with tests #12,#13 and #19 I disagree.