Fix name constraints code to pass NIST PKITS test 38. r=wtc. Bug 231223.
Fix name constraints code to pass NIST PKITS test 38. r=wtc. Bug 231223.

ekr/nss-old,nmav/nss,nmav/nss,ekr/nss-old,nmav/nss,nmav/nss,nmav/nss,ekr/nss-old,ekr/nss-old,ekr/nss-old,nmav/nss,ekr/nss-old,nmav/nss,ekr/nss-old