strip all trailing dots in name-constraint host canonicalization

[rootvector2]

PKIXNameConstraintValidator.stripTrailingDot removed only one RFC 1034 root-label dot, so a dNSName, rfc822Name host or uniformResourceIdentifier host carrying two or more trailing dots kept a phantom empty label after the strip and missed the exact-match check. a SAN such as example.com.. is a legal IA5String the certificate parser never validates for DNS well-formedness, so it reaches the validator unchanged and escapes an excluded example.com subtree (RFC 5280 sec. 4.2.1.10). the same helper is shared by the email and URI host paths, so ceo@bank.com.. and https://competitor.example../ escape the same way. found while extending the single-dot testTrailingDotBypass case that already guards this class.

stripTrailingDot now strips every trailing dot, keeping the lower bound of 1 that preserves a bare .. one change closes the dNSName, rfc822Name and URI paths at once; single-dot handling and sibling-domain non-matching are unchanged. PKIXNameConstraintsTest.testTrailingDotBypass gains double- and triple-dot cases for each path, and fails without this change.

AI tooling was used to help prepare this change.