fix(sct): return cert_is_ca result in _cert_is_ca

[xovishnukosuri]

What

_cert_is_ca in sigstore/_internal/sct.py calls cert_is_ca(cert) but discards its return value, then unconditionally returns True if no exception was raised:

def _cert_is_ca(cert: Certificate) -> bool:
    try:
        cert_is_ca(cert)          # return value ignored
    except VerificationError as e:
        return False
    return True                   # True even when cert_is_ca() returned False

Why this is a bug

cert_is_ca() (in sigstore/_utils.py) returns False without raising when a certificate has no BasicConstraints extension. In that case _cert_is_ca incorrectly returns True, treating a non-CA certificate as a valid SCT issuer.

This means that during SCT verification for precertificates, a certificate without a BasicConstraints extension would pass the issuer CA check at line 205:

if not _cert_is_ca(issuer_cert):
    raise VerificationError(...)

Fix

Propagate the return value: return cert_is_ca(cert).

All 174 unit tests pass.