actually distinguish the following BasicConstraint cases:

 CA = false ; _             -> Basic_constraint (false, _)
 CA = true  ; no maxpathlen -> Basic_constraint (true,  None)
 CA = true  ; maxpathlen n  -> Basic_cosntraint (true,  Some n)

and allow only the first for server certificates, the latter two for
CA certificates