Schannel custom-CA path skips Extended Key Usage enforcement

We believe the Schannel custom-CA verification path in `lib/vtls/schannel_verify.c` may skip Extended Key Usage enforcement. In particular, a certificate that chains to the trusted custom CA but contains only `id-kp-clientAuth`, rather than `id-kp-serverAuth`, may pass peer verification on Windows …

CERT_CHAIN_PARA ChainPara;

memset(&ChainPara, 0, sizeof(ChainPara));
ChainPara.cbSize = sizeof(ChainPara);

if(!CertGetCertificateChain(cert_chain_engine,
                            pCertContextServer,
                            NULL,
                            pCertContextServer->hCertStore, …