Fix invalid policy detection
Fix invalid policy detection

As a side-effect of opaque x509, ex_flags were looked up too early,
before additional policy cache updates.

Reviewed-by: Dr. Stephen Henson <9ce5770b3bb4b2a1d59be2d97e34379cd192299f@openssl.org>

openssl/openssl,openssl/openssl,openssl/openssl,openssl/openssl,openssl/openssl,openssl/openssl