Fix certificate path building at trust anchors

[Scratch-net]

Description

• Build the certificate path from the leaf and stop after a trusted issuer validates the current certificate.
• Prefer trust-store issuers over redundant server-supplied cross-signs.
• Normalize distinguished names and use AKI/SKI values to disambiguate issuer keys.
• Add regression coverage and bump the package version to 0.1.4.
• Renew the localhost test certificate through August 29, 2036.

Testing (ignore for documentation update)

• npm run build
• npm run lint
• npm run test:pure-js (50 tests passed)
• npm run test:webcrypto (50 tests passed)
• npm pack --dry-run

Type of change

• Bug fix
• New feature
• Breaking change
• Documentation update

Checklist:

• I have read and agree to the Code of Conduct.
• I have signed the Contributor License Agreement (CLA).
• I have considered the Security Policy.
• I have self-reviewed and tested my code.
• I have updated documentation as needed.
• I agree to the project's custom license.

Additional Notes:

The regression reproduces a chain that contains a trusted root cross-signed by an untrusted legacy root. It also generates certificates whose issuer and subject DNs differ in case and insignificant spacing, with matching and mismatching key identifiers.