tls: load all CRLs from a PEM bundle

[lazerg]

AddCRL() read a single PEM block and returned, so a crl option holding several concatenated CRLs only ever got its first entry into the store. Any certificate whose issuer's CRL came later in the bundle then failed with UNABLE_TO_GET_CRL.

Read in a loop until the BIO is exhausted, the way AddCACertificates() right above it already does for ca bundles.

Fixes: #65576

[nodejs-github-bot]

Review requested:

• @nodejs/crypto

[codecov]

Codecov Report

❌ Patch coverage is 71.42857% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.08%. Comparing base (abb365a) to head (02967d3).
⚠️ Report is 5 commits behind head on main.

Files with missing lines	Patch %	Lines
src/crypto/crypto_tls_certificates.cc	71.42%	0 Missing and 4 partials ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #65577   +/-   ##
=======================================
  Coverage   90.07%   90.08%           
=======================================
  Files         751      751           
  Lines      254875   254882    +7     
  Branches    48115    48113    -2     
=======================================
+ Hits       229586   229600   +14     
+ Misses      16467    16463    -4     
+ Partials     8822     8819    -3     

Files with missing lines	Coverage Δ
src/crypto/crypto_tls_certificates.cc	71.18% <71.42%> (+0.03%)	⬆️

... and 33 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[pimterry]

LGTM.

There is a question on whether this should be semver major that others might want to chime in on: before, loading a CRL bundle where the first CRL was valid but others were broken was successful - now it fails if any CRLs in the bundle can't be loaded.

Personally I think it's reasonable as a bug fix - you clearly want to load the CRLs and not doing so was a silent error before - but I could be persuaded if anybody else feels strongly.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/76575/

[lazerg]

The red on node-test-commit comes from the first node-test-commit-windows-fanned attempt, build 79686, which went from pending to failed in eight seconds. The rerun, build 79689, passed, and every other platform in that run is green. A fresh CI run should clear it.