curl GnuTLS backend accepts a clientAuth-only certificate for HTTPS server authentication

Summary: When curl/libcurl is built with the GnuTLS backend, the current HTTPS server-certificate validation path verifies the trust chain and hostname but does not enforce TLS server Extended Key Usage semantics. As a result, a leaf certificate that chains to a trusted CA, matches the requested …

gnutls_certificate_set_verify_flags(creds,
                                    GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT);