fix(webtransport): validate certificate dates (#36069)
## Summary
- parse fingerprint-authenticated WebTransport certificates before
accepting them
- reject matching certificates before `notBefore` or after `notAfter`
- add deterministic tests for valid, not-yet-valid, and expired
certificate times
## Bug
The custom certificate verifier compared the configured SHA-256
fingerprints but ignored the verification time supplied by rustls. A
certificate with a matching fingerprint was therefore accepted even when
the current time was outside its encoded validity interval.
The verifier now parses the matching certificate and returns the
corresponding rustls certificate error when its dates are not current.
## Validation
- `./tools/format.js`
- `cargo fmt --check --package deno_net`
- `cargo test -p deno_net
fingerprint_certificate_must_be_currently_valid --lib`
- `cargo build --bin deno`
- existing fingerprint-authenticated WebTransport connection spec
