check X509_NAME_get_text_by_NID return in credential name checks

[aizu-m]

X509_NAME_get_text_by_NID() returns -1 and leaves its output buffer untouched when the requested NID is absent. A certificate with no commonName (SAN-only, normal for modern certs) takes that path, and the openssl backend uses the buffer regardless:

char subjectName[256];
X509_NAME_get_text_by_NID(..., NID_commonName, subjectName, sizeof(subjectName));  // -1, subjectName untouched
...
_cups_strcasecmp(common_name, subjectName)   // reads uninitialised stack

Found while reading the trust path. cupsGetCredentialsTrust() (the https client certificate check reached from http.c) hands an untrusted server certificate to both cupsAreCredentialsValidForName() and cupsGetCredentialsInfo(), so for a CN-less certificate the name comparison and the "%s (issued by %s)" description both run on uninitialised name[256]/issuer[256]. The snprintf %s then scans past the 256-byte buffer into adjacent stack, so it is an out-of-bounds read and a stack disclosure, and the name check comes out depending on stack residue. With a self-signed no-CN certificate I could get cupsAreCredentialsValidForName() to return true for an unrelated hostname.

The gnutls backend already falls back to "unknown" for the missing-CN case. This checks the return value and does the same at each X509_NAME_get_text_by_NID call in the file.