[Bug]: `x509_v2` mishandles some GeneralNames

What happened?

There are some valid GeneralName values that are not accepted by salt.utils.x509._parse_general_names and invalid ones that are. It also does not differentiate properly between regular GeneralNames and the ones used in the nameConstraints extension. Most of them affect the URI type. Some shoutouts:

1. nameConstraints URI: Must be in the same format as DNS, but .foo.bar is not accepted and https://foo.bar is.
2. URI: We automatically encode unicode in the hostname portion according to IDNA. We should automatically encode other segments according to IRI.
3. URI: IPv6 addresses as hostname result in an exception.
4. URI: One without an authority (like mailto:foo@b.ar) is silently dropped.
5. URI: Regular ones require a scheme, but we don't.
6. URI: The hostname can be an explicit absolute root (foo.bar.), which is rejected.
7. email: We IDNA-encode the domain, but we don't check for unicode in the local (user) part, which is invalid. Unicode email addresses should be put into an otherName of SmtpUTF8Mailbox type.
8. IP: A regular IPAddress must contain a single address, but we additionally accept network ranges.
9. nameConstraints IP: IPAddress must contain a network range, but we additionally accept IP addresses.
10. DNS: While not following more modern TLS specs, foo*.bar.baz and foo.*.bar used to be valid wildcard definitions and could still be used by other specs. They result in an exception currently.

Type of salt install

Official deb

Major version

3006.x, 3007.x, 3008.x

What supported OS are you seeing the problem on? Can select multiple. (If bug appears on an unsupported OS, please open a GitHub Discussion instead)

ubuntu-24.04

salt --versions-report output

Latest HEAD of 3006.x

Start in salt.utils.x509._parse_general_names and map the listed URI, email, IP, DNS, and nameConstraints cases to their expected valid or invalid behavior. Compare regular GeneralNames with nameConstraints handling, then verify that each listed distinction is covered by the relevant x509 tests; done means valid values are accepted, invalid values are rejected, and no listed cases are silently dropped or raise unexpectedly.