Bundle should ensure intermediates outlast EE certs

Let's say we have I1 and I2 singing the same EE cert, with I2 expiring later, and I1 expiring before the EE cert. If I1 expires ahead of the EE cert, the bundle will fail to verify ahead of the certificate expiration. Unfortunately we will sometimes include I1 in the bundle instead of I2.

Start by locating the bundle-building and intermediate-selection entry points in the Go repository, then trace how competing intermediates are chosen for an EE certificate. Reproduce the case with I1 and I2, where I2 expires later, and verify that the resulting bundle continues to verify through the EE certificate's expiration.

Written by the indexing model from the issue text.