bug 1040446 - mozilla::pkix: add error code for CA cert used as end-entity cert r=briansmith