Server impersonation via CA-bundle trust bypass

Improper certificate validation in built-in TLS in Cesanta Mongoose before 7.23 allows network attackers to impersonate TLS servers via a forged certificate chain. In src/tls_builtin.c, mg_tls_init() stores multi-certificate CA bundles in tls->ca_bundle_der, but mg_tls_recv_cert() only finds a bundle entry whose subject Common Name matches the presented issuer Common Name and skips mg_tls_verify_cert_signature() for the topmost certificate. Only built-in-TLS client configurations that use a multi-certificate CA bundle are exposed, enabling man-in-the-middle interception, credential disclosure, traffic modification, and attacker-controlled responses.