asn1_multi: rework creation of the returned stack
Currently, the ASN1_TYPE ret is created up front and further populated
via a possibly failing call to ASN1_STRING_type_new(). On failure, the
incomplete ret is returned, indicating success to the caller, which may
or may not fail later.
Instead, create the inner ASN1_STRING first, then the ASN1_TYPE. Use
setter API with proper ownership transfer rather than fiddling with
deeply nested ASN1 structures. This way we only succeed if everything
actually succeeded.
ok kenjiro
asn1_multi: plug leak if sk_ASN1_TYPE_push() fails
If the push of typ onto sk fails, the exit path does not free it.
Fix that and avoid function nesting when calling ASN1_generate_v3().
Prompted by a similar fix in OpenSSL
ok kenjiro
IANA has allocated a non-vendor codepoint for ssh-mldsa44-ed25519,
so use it instead of the vendored "@openssh.com" name.
Note: this replaces the vendored name, which was only marked as
experimental and not enabled by default.cw
If you have ssh-mldsa44-ed25519 at openssh.com keys manually configured
in sshd, then you will need to remove them from sshd_config and
restart.