fix(node_crypto): prefer SAN in X509Certificate.checkHost

[nathanwhit]

Summary

• prefer DNS subject alternative names when matching hostnames
• preserve common-name fallback when no DNS subject alternative name is present
• align case-insensitive and wildcard matching with Node and OpenSSL behavior

Details

The compatibility implementation checked the subject common name before DNS subject alternative names and returned the caller's input rather than the certificate name that matched. This updates the host-check path to evaluate DNS subject alternative names first, apply the configured subject and wildcard policies, and return the matched certificate name. IP subject alternative names continue to be handled by checkIP().

Tests

• ./tools/format.js --check
• cargo clippy -p deno_node_crypto --all-targets -- -D warnings
• cargo test -p deno_node_crypto --lib
• cargo build --bin deno
• cargo build -p test_server
• cargo test -p unit_node_tests --test unit_node -- unit_node::crypto::crypto_key_test --nocapture