crypt32: Only permit v1 or v2 CA certificates without a basic constraints extension...