A certificate in the system store that doesn’t strictly follow the spec (for example: one using UTF8String instead of the X.509 spec's PrintableString for the country field) crashed the blocklist filter and made all https requests fail. This happened for any malformed certificates that are in the system store even if they're not used.
This PR switches the blocklist check to the lenient decoder that TLS already uses, in order to not crash with slightly malformed certs. 2 additional tests were also added to make sure malformed versions of trusted and blocked certs still work correctly.