fix: correctly handle TLS identities for IP literals

[M1k0t0]

Description

Fix TLS endpoint identity handling when the configured host is a literal IPv4 or IPv6 address.

This change:

• Omits the complete TLS server_name extension for IP literals.
• Verifies IP identities exclusively against X.509 subjectAltName.iPAddress entries.
• Compares IP identities using their exact canonical 4-byte or 16-byte representation.

Implementation

• Add a runtime-portable host identity classifier implemented with standard JavaScript and Uint8Array, no Node-only net.isIP() dependency is introduced.
• Parse strict dotted-decimal IPv4 and standard compressed or expanded IPv6 forms into canonical bytes.
• Omit the SERVER_NAME extension when constructing a ClientHello for an IP reference.
• Extract iPAddress SAN values separately from dNSName SAN values.
• Match IP identities using exact byte equality.
• Keep IPv4 and IPv4-mapped IPv6 identities distinct.
• Reject unsupported or ambiguous host forms.

Tests

Added coverage for:

• Canonical IPv4 and IPv6 parsing.
• Equivalent compressed and expanded IPv6 representations.
• Embedded IPv4 forms in IPv6 addresses.
• Rejection of malformed and unsupported host identities.
• Presence of DNS SNI and complete omission of SNI for IP literals.
• Exact IPv4 and IPv6 iPAddress SAN matching.
• Rejection of mismatched IP SANs.
• Rejection of IP-valued CN and dNSName fields.
• IPv4 versus IPv4-mapped IPv6 separation.
• Fail-closed behavior for custom certificate adapters without an IP SAN API.
• Preservation of existing DNS wildcard behavior.
• Prevention of accidental public export of the host parser.
• Certificate fixture expiration monitoring.

Also added the browser/JavaScriptCore bundle build to CI.

Type of change

• Bug fix
• New feature
• Breaking change
• Documentation update

Checklist:

• I have read and agree to the Code of Conduct.
• I have signed the Contributor License Agreement (CLA).
• I have considered the Security Policy.
• I have self-reviewed and tested my code.
• I have updated documentation as needed.
• I agree to the project's custom license.

Additional Notes:

The existing cert/public-cert.pem test certificate expired on July 29, 2026. This caused the existing localhost TLS integration test to fail certificate validity checks and eventually time out during the handshake.

This PR renews that public test certificate using the repository's existing tracked test key while preserving its localhost identity and CA behavior. The renewed certificate is valid through August 2036.

[CLAassistant]

All committers have signed the CLA.