update x509-limbo to latest

This brings in several new test cases:

* Some new pathological chain building tests sourced from the Go test
  suite. We pass these as-expected.
* A test for CVE-2025-61727, testing a name constraint issue from Go
  related to excluded subdomain constraints for wildcard leaf SANs. We
  pass this test as-expected.
* Additional PSL wildcard SAN tests. We don't reject these when the test
  expects we should. This is because they require taking a dependency on
  the public suffix data, which is both large & frequently changing.
  We add these tests to our exceptions.json

Additionally, upstream fixed a typo in two webpki::rsa test cases that
we already had exceptions.json entries for. We update these to match the
new name.

Author: cpu

Cargo.lock

@@ -83,7 +83,7 @@ untrusted = "0.9"
 base64 = "0.22"
 bencher = "0.1.5"
 chrono = "0.4"
-limbo-harness-support = { git = "https://github.com/C2SP/x509-limbo", rev = "700bc657992b688f305f8f3ce08195da04543545" }
+limbo-harness-support = { git = "https://github.com/C2SP/x509-limbo", rev = "1983423436313a6605461056470e21242d066416" }
 once_cell = "1.17.2"
 rcgen = { version = "0.14.7", default-features = false, features = ["aws_lc_rs"] }
 rustls-aws-lc-rs = { version = "0.1.0-dev.0" }

Cargo.toml

@@ -254,6 +254,16 @@
     "actual": "SUCCESS",
     "reason": "webpki does not enforce CABF requirement that SAN not be critical when subject is non-empty"
   },
+  "webpki::san::public-suffix-multi-label-wildcard-san": {
+    "expected": "FAILURE",
+    "actual": "SUCCESS",
+    "reason": "webpki does not take a public-suffix data dependency to enforce this CABF requirement"
+  },
+  "webpki::san::public-suffix-private-namespace-wildcard-san": {
+    "expected": "FAILURE",
+    "actual": "SUCCESS",
+    "reason": "webpki does not take a public-suffix data dependency to enforce this CABF requirement"
+  },
   "webpki::malformed-aia": {
     "expected": "FAILURE",
     "actual": "SUCCESS",
@@ -274,12 +284,12 @@
     "actual": "SUCCESS",
     "reason": "webpki does not enforce CABF RSA key size minimum (1024-bit accepted)"
   },
-  "webpki::forbidden-rsa-not-divisable-by-8-in-root": {
+  "webpki::forbidden-rsa-not-divisible-by-8-in-root": {
     "expected": "FAILURE",
     "actual": "SUCCESS",
     "reason": "webpki does not enforce CABF requirement that RSA key size be divisible by 8"
   },
-  "webpki::forbidden-rsa-key-not-divisable-by-8-in-leaf": {
+  "webpki::forbidden-rsa-key-not-divisible-by-8-in-leaf": {
     "expected": "FAILURE",
     "actual": "SUCCESS",
     "reason": "webpki does not enforce CABF requirement that RSA key size be divisible by 8"