Go will reject certificate chains containing eight distrusted SPKIs

Filter a set of intermediates from chains returned by calls to Verify. These chains are identified via SHA-256 SPKI hashes. Fixes CVE-2026-111943 For golang/go#82345 Fixes golang/go#82349 Change-...