Improve error message when denying subject name due to wildcard in public suffix

Checklist

• I've searched the issue tracker for similar requests

Is your feature request related to a problem? Please describe.
When a subject name is checked with EndEntityCert::verify_is_valid_for_subject_name, wildcard SAN names are skipped if the public suffix is the wildcard asterisk (ie *.com).

Describe the solution you'd like
Either have a way to allow using these short names with wildcards, or mention that there must be at least two labels after the wildcard in the error message.

Describe alternatives you've considered
I could just use lab.localhost + *.lab.localhost or something similar.

Additional context
I discovered this when I was playing with quinn and a certificate generated with:

#!/usr/bin/env bash

# make CA key and certificate
openssl req -x509 -newkey ed25519 \
  -nodes \
  -keyout ca.key \
  -sha256 -days 3650 \
  -out ca.crt \
  -subj "/CN=localhost"

# create key for server
openssl ecparam -genkey \
  -name prime256v1 \
  -noout -out localhost.key

# create certificate signing request for server
openssl req -new -sha256 \
  -key localhost.key \
  -subj "/CN=localhost" \
  -out localhost.csr

cat > localhost.ext <<EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature,keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1 = localhost
DNS.2 = *.localhost
EOF

# sign the CSR
openssl x509 -req \
  -in localhost.csr \
  -CA ca.crt -CAkey ca.key \
  -CAcreateserial -days 365 -sha256 -extfile localhost.ext \
  -out localhost.crt

Connecting using localhost as the hostname worked, but trying test.localhost failed with

the cryptographic handshake failed: error 42: invalid peer certificate: certificate not valid for name "test.localhost"; certificate is only valid for DnsName("localhost") or DnsName("*.localhost")

which doesn't represent why it was actually denied.

This issue was brought up before in https://github.com/rustls/rustls/issues/1222, but didn't seem to lead anywhere.