Tolerate certificate chain errors related to private CAs

[hxmf]

For a private CA where unavailable revocation information is acceptable, ignore the "unknown" and "offline" errors while preserving all other certificate errors.

[yhirose]

Thank you for finding this. The problem is real: on Windows, a server certificate with an unknown revocation status has been rejected since v0.31.0, although the chain policy check was already told to ignore it.

I am fixing it in #2618 in a different way. It removes the trust status pre-check, so that CertVerifyCertificateChainPolicy() is the only place that judges the chain and the policy is stated once. The case you describe, a private CA without revocation information, is accepted with that change, and a revoked certificate is still rejected.

Closing in favor of #2618.