[go1.24] smx509: decouple key usage and policy validation

[emmansun]

Disabling key usage validation (by passing ExtKeyUsageAny) unintentionally disabled policy validation. This change decouples these two checks, preventing the user from unintentionally disabling policy validation.

I’m not sure if smx509 can make the same change.

golang/go@9bba799