Generated MITM certificates fail strict X509 verification (missing leaf AKI and CA key usage) #263

Reproduction

On upstream 56d57b68c5d5bf2a2fadfe9c19f2ec6f28d14977 (0.8.9), a Python 3.13.3
HTTPS request through --http-inject-ca fails with certificate verification
enabled:

ssl.SSLCertVerificationError: certificate verify failed: Missing Authority Key Identifier

The generated leaf is signed by the MITM CA but does not set rcgen's
use_authority_key_identifier_extension.

Setting only that field exposes a second strict-verification failure:

certificate verify failed: CA cert does not include key usage extension

The generated CA declares IsCa::Ca but does not declare signing key usage.
Both changes are needed: leaf AKI and CA KeyCertSign (plus CrlSign).

Verified fix

With both changes, a real loopback HTTPS server receives an injected synthetic
bearer credential from a sandboxed Python client with VERIFY_X509_STRICT
explicitly enabled. No CERT_NONE, -k, verification-flag relaxation, global
trust-store modification or cloud credential is involved. The same probe
fails against the unmodified binary.

Environment: Ubuntu 25.04 ARM64 under OrbStack, Linux 7.0.14, Landlock ABI 8,
Python 3.13.3. This report does not claim HTTPS-only credential enforcement;
that is a separate transport-policy concern.

A standalone stdlib Python + OpenSSL integration probe and Rust test launcher
are included in the accompanying minimal fix PR.