[photonlibos]

test(net): build test certificates where the subject name comes back const (#1723)

• test(net): take a writable subject name when building test certificates

The macOS arm image's X509_get_subject_name() returns a const X509_NAME*, while
X509_NAME_add_entry_by_txt() and X509_set_issuer_name() take a mutable one, so
client_function_test stopped compiling there -- the intel image's OpenSSL returns
the mutable pointer and was fine. The certificates are ours and writable, so the
five call sites go through one helper that takes the writable view back.

• test(net): say why one const_cast covers both OpenSSL signatures

The getter's return qualifier follows whichever headers are installed, so the fix
must not key off a version: removing no qualifier is a no-op, which is what lets
the single helper compile unchanged against the mutable and the const signature.
Generated by Backport Auto PR, by cherry-pick related commits.

Please review and decide whether to merge or close this backport PR.

Conflicts (resolved)

Cherry-pick of 28d396e conflicted in net/security-context/test/test_cert_utils.h. Resolved in f0dba63:

• The conflicting hunk was the TestCertChain / generate_ca_signed_cert() block (with test_generate_rsa_key, test_pem_of_cert, test_pem_of_key, test_set_cert_name). Those helpers come from a main-only change and nothing on release/0.9 uses them, so the release/0.9 side was kept and the block dropped.
• What remains is the actual fix of test(net): build test certificates where the subject name comes back const #1723: the test_subject_name() helper and its one applicable call site in generate_different_self_signed_cert(). The other four call sites in test(net): build test certificates where the subject name comes back const #1723 live inside the dropped helpers.

Verified locally (aarch64, GCC 15, Debug): test-tls and client_tls_test build; test-tls passes 15/15, including ca_cert.verify_fail_wrong_ca, which exercises the changed code. client_tls_test aborts identically on unmodified release/0.9 in this environment (localhost resolves to ::1 while the server binds 127.0.0.1), so it is unrelated to this backport; CI is relied on for it.