Support the new `x509.Certificate.Policies` field

[Juneezee]

From Go 1.22 changelog:

crypto/x509

A new type, OID, supports ASN.1 Object Identifiers with individual components larger than 31 bits. A new field which uses this type, Policies, is added to the Certificate struct, and is now populated during parsing. Any OIDs which cannot be represented using a asn1.ObjectIdentifier will appear in Policies, but not in the old PolicyIdentifiers field. When calling CreateCertificate, the Policies field is ignored, and policies are taken from the PolicyIdentifiers field. Using the x509usepolicies=1 GODEBUG setting inverts this, populating certificate policies from the Policies field, and ignoring the PolicyIdentifiers field. We may change the default value of x509usepolicies in Go 1.23, making Policies the default field for marshaling.

And there is a commit https://github.com/golang/go/commit/918765b619b87a603c40b331bd5f5e2335d265f0 already in Go 1.24 RC1 that changes to use Policies field by default.