Improve API of X.509

[reneme]

Collection of potential improvements on the public (and perhaps internal) X.509 API of the library.

• Path_Validation_Restrictions are currently created with a constructor that is becoming quite bloated with defaulted parameters. Perhaps extend this with a builder-style API (see: X509 Path Validation Flag to Ignore Root Certificate Lifetime #3938 (comment))
• Async/Callback API hooks for providing additional X.509 artifacts during path validation.
  • Asynchronous Certificate Validation #2368
  • Callback API for X.509 path building #3124
• Improve FFI API coverage: FFI APIs for X.509 are insufficient #3627
• X509_Cert_Options could use a builder API (or likely better, offer a builder-based alternative, and then we can deprecate X509_Cert_Options entirely)