NameConstraints must include a mask when serializing IPAddress

[Knagis]

Currently serializing and deserializing NameConstraints use the AsnIpConverter same as for example SubjectAlternativeName, resulting in plain IP Address being serialized.

However, RFC 5280 state that the IP Address in name constraints MUST have a mask.

[microshine]

This PR resolves the issue by ensuring that the NameConstraints IP address fields are always serialized with a mask, as required by RFC 5280. The new implementation adds logic to handle masks in both serialization and deserialization with AsnIpConverter.

Supported Formats and Usage Examples

Here's how to use IP addresses in NameConstraints:

const nameConstrains = new NameConstraints({
  permittedSubtrees: new GeneralSubtrees([
    // IPv4 examples
    new GeneralSubtree({
      base: new GeneralName({
        iPAddress: "192.168.1.0/24", // Using CIDR notation
      }),
    }),
    // IPv6 examples
    new GeneralSubtree({
      base: new GeneralName({
        iPAddress: "2001:db8::/64", // IPv6 with CIDR
      }),
    }),
  ]),
});

Supported IP Address Formats:

The module now handles IP addresses in the following formats:

IPv4 Support:

• Plain address: "192.168.0.1" → 4 bytes binary
• With CIDR: "192.168.0.0/24" → 8 bytes (4 bytes address + 4 bytes mask)
• Special case: "0.0.0.0/0" for any IPv4 address

IPv6 Support:

• Plain address: "2001:db8:85a3::8a2e:370:7334" → 16 bytes binary
• With CIDR: "2001:db8::/64" → 32 bytes (16 bytes address + 16 bytes mask)
• Special case: "::/0" for any IPv6 address

[Knagis]

I can confirm the latest version now correctly serializes the mask when provided.

However, i would argue that either a) it should throw when given the IP without a mask or b) it should add mask /32 or /128 (255.255.255.255 or ffff:ffff...) automatically if the mask isn't given (since mask with all bits is allowing just the IP itself)

the issue is that i don't remember anything complaining about the lack of mask in the name, everything seemed to be happily just showing the IP in the constraint and the certificate just wouldn't be accepted. took me quite a while to figure out the mask is mandatory and either a or b would hopefully save the time for someone else.