Properly handle RFC5280 DNS Name Constraints that start with a dot as in mozilla::pkix

Stock openssl breaks when enforcing DNS restrictions that start with a leading dot (e.g. 'DNS:.foo.bar' ). This does not work well with CAs that SHOULD NOT be able to sign certs for any domain such as "foo.bar" itself, but SHOULD be able to sign certs for subdomain-only DNS names, such as "host.foo.bar".
This commit allows strict DNS restrictions to be enforced properly by openssl. 
These restrictions are already supported by mozilla::pkix https://hg.mozilla.org/mozilla-central/file/e9b2b72f4e6c/security/nss/lib/certdb/genname.c:1216