[release-branch.go1.25] crypto/x509: fix single label excluded name constraints handling
Only strip labels when both the domain and constraint have more than one
label.
Fixes #76935
Fixes #77323
Change-Id: Ifdaae2cbe0c57984bb7334a8f08fa33a800e7c27
Reviewed-on: https://go-review.googlesource.com/c/go/+/739400
Auto-Submit: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>