src: enable X509sToArrayOfStrings to skip errors

[StefanStojanovic]

As suggested in the linked issue, this PR relaxes the X509 to PEM conversion by skipping failures for system certs. If conversion fails, Node.js will try to give info about the failed certs if it can. This new behavior is used only on system certs, since for others, the user has control. AFAIK, there is no way to add a reliable test for this, but if someone has an idea, feel free to share it with me.

Fixes: #61636

[nodejs-github-bot]

Review requested:

• @nodejs/crypto

[codecov]

Codecov Report

❌ Patch coverage is 23.33333% with 23 lines in your changes missing coverage. Please review.
✅ Project coverage is 89.69%. Comparing base (9a237cd) to head (61e3e8e).
⚠️ Report is 97 commits behind head on main.

Files with missing lines	Patch %	Lines
src/crypto/crypto_context.cc	23.33%	21 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #61784      +/-   ##
==========================================
- Coverage   89.73%   89.69%   -0.04%     
==========================================
  Files         675      672       -3     
  Lines      204674   204549     -125     
  Branches    39330    39274      -56     
==========================================
- Hits       183667   183480     -187     
- Misses      13283    13383     +100     
+ Partials     7724     7686      -38     

Files with missing lines	Coverage Δ
src/crypto/crypto_context.cc	69.59% <23.33%> (-1.25%)	⬇️

... and 81 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[joyeecheung]

I wonder if we should make this an option to the API instead of unconditionally emitting a warning? So if the user uses tls.getCACertifcate, they can choose warn, ignore, throw (or even get a list of errors on the side) when there's an error in parsing these certificates. For NODE_USE_SYSTEM_CA/--use-system-ca, warn is a sensible behavior.

[StefanStojanovic]

I'm open to any suggestions. If you have an exact option/setting in mind, let me know, and I'll adapt the change to work in that way.