[release-branch.go1.24] crypto/x509: fix single label excluded name constraints handling
Only strip labels when both the domain and constraint have more than one
label.
Fixes #76935
Fixes #77322
Change-Id: I1144c9f03cbfc3b858af153a839b193bb934618d
Reviewed-on: https://go-review.googlesource.com/c/go/+/739420 Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
Auto-Submit: Dmitri Shuralyov <dmitshur@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com>