Expose all x509 verification policy options

Although the library does a pretty good job of validating X.509 certificates following the WebPKI spec, it currently does not expose everything to allow implementing policies from other specifications or implementations.

In my case, I try to verify (legacy) code signing certificates with low RSA moduli, but minimum_rsa_modulus is not exposed to the PolicyBuilder API.

It could make sense to wrap this in some sort of algorithm policy, but perhaps that is making it more complicated than really needed. It should at least be possible to disable this check, or specify a different minimum modulus.

Additionally, it appears not possible to modify the extended_key_usage it checks for in EE certificates. Perhaps this could be worked around by defining an ExtensionPolicy, but that will require some additional (duplicate) code.

There may be more policy related settings that are unmodifiably defaulted to WebPKI standards. I believe all of these should be modifiable (or entirely disableable) by a custom policy.

permitted_public_key_algorithms and permitted_signature_algorithms were already identified and tracked in #13391

Start at the PolicyBuilder API and trace how minimum_rsa_modulus and extended_key_usage are currently fixed during certificate verification. Review the already tracked permitted_public_key_algorithms and permitted_signature_algorithms work in #13391, then identify the complete set of WebPKI-defaulted policy settings and define how a custom policy should configure or disable them. Done means the policy surface and its expected behavior are agreed and covered by tests.