[jdk21u-dev] RFR: 8346587: Distrust TLS server certificates anchored by Camerfirma Root CAs

[Antonio Vieiro]

Clean backport of [JDK-8346587](https://bugs.openjdk.org/browse/JDK-8346587) to distrust TLS server certificates issued after April 15, 2025 and anchored by Camerfirma Root CAs. Low risk.

It passes tier1 tests and also all jdk/sun/security tests:


==============================
Test summary
==============================
   TEST                                              TOTAL  PASS  FAIL ERROR   
   jtreg:test/jdk/sun/security                         795   795     0     0   
==============================
TEST SUCCESS

-------------

Commit messages:
 - Backport d2262fe4e9b3118d4c4ab152aa2771b744398367

Changes: https://git.openjdk.org/jdk21u-dev/pull/1388/files
  Webrev: https://webrevs.openjdk.org/?repo=jdk21u-dev&pr=1388&range=00
  Issue: https://bugs.openjdk.org/browse/JDK-8346587
  Stats: 392 lines in 8 files changed: 388 ins; 0 del; 4 mod
  Patch: https://git.openjdk.org/jdk21u-dev/pull/1388.diff
  Fetch: git fetch https://git.openjdk.org/jdk21u-dev.git pull/1388/head:pull/1388

PR: https://git.openjdk.org/jdk21u-dev/pull/1388