Fix PKICertImport test by adding basicConstraints to intermediate CA

The ca_sub_signing.conf was missing the basicConstraints extension
which is required for NSS to recognize a certificate as a valid CA.
This caused test_chain_import to fail with "Certificate type not
approved for application" when verifying intermediate CA certificates.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: edewata

base/tools/src/test/resources/certs/ca_sub_signing.conf

@@ -1,5 +1,6 @@
 authorityInfoAccess    = OCSP;URI:http://ocsp.example.com/
 subjectKeyIdentifier   = hash
-authorityKeyIdentifier = keyid:always 
+authorityKeyIdentifier = keyid:always
+basicConstraints       = critical, CA:TRUE
 keyUsage               = critical, digitalSignature, nonRepudiation, keyCertSign, cRLSign