x509_str: require CA:TRUE unconditionally in wolfSSL_X509_verify_cert

Drop the OPENSSL_ALL / WOLFSSL_QT preprocessor guard on the basicConstraints
cA check so non-CA issuers are rejected in every OpenSSL-compat build.
OPENSSL_EXTRA-only builds previously installed an attacker-supplied CA:FALSE
leaf as a temporary CA via X509StoreAddCa(..., WOLFSSL_TEMP_CA), bypassing
RFC 5280 4.2.1.9. The verify_cb override path stays gated on OPENSSL_ALL /
WOLFSSL_QT since that field only exists there. Continuation of the
CVE-2026-5501 fix.

Author: julek-wolfssl

src/x509_str.c

@@ -705,28 +705,26 @@ int wolfSSL_X509_verify_cert(WOLFSSL_X509_STORE_CTX* ctx)
 
             /* We found our issuer in the non-trusted cert list, add it
              * to the CM and verify the current cert against it */
-        #if defined(OPENSSL_ALL) || defined(WOLFSSL_QT)
-            /* OpenSSL doesn't allow the cert as CA if it is not CA:TRUE for
-             * intermediate certs.
-             */
+            /* RFC 5280 4.2.1.9: reject non-CA issuer. */
             if (!issuer->isCa) {
-                /* error depth is current depth + 1 */
                 SetupStoreCtxError_ex(ctx, X509_V_ERR_INVALID_CA,
                                 (ctx->chain) ? (int)(ctx->chain->num + 1) : 1);
+            #if defined(OPENSSL_ALL) || defined(WOLFSSL_QT)
                 if (ctx->store->verify_cb) {
                     ret = ctx->store->verify_cb(0, ctx);
                     if (ret != WOLFSSL_SUCCESS) {
                         ret = WOLFSSL_FAILURE;
                         goto exit;
                     }
                 }
-                else {
+                else
+            #endif
+                {
                     ret = WOLFSSL_FAILURE;
                     goto exit;
                 }
-            } else
-        #endif
-            {
+            }
+            else {
                 ret = X509StoreAddCa(ctx->store, issuer,
                                                 WOLFSSL_TEMP_CA);
                 if (ret != WOLFSSL_SUCCESS) {