Delete chain filtering by extensions

[phbnf]

It's not clear to me why the CTFE has this feature, let's remove it unless there's a good reason to keep it.

[roger2hk]

Can you post the link to the code?

[phbnf]

It's a bit all over the place, but here's is an entry point. This is when it was added to the CTFE, so maybe @AlCutter has more context that I'm missing on. I'm wondering whether that was to reject BIMI/VMC certificates. Since there's now also a mechanism to allowlist specific EKUs, I don't think we need the Extension denylist anymore.