credential-manager: Check expiry also for last cert in incomplete trust chain

While the validity of a pre-trusted certificate for which an issuer is
found is enforced via `check_certificate()`, the validity of such a
certificate in an incomplete trust chain, or rather that of the last
certificate in such a chain, was not enforced.  This fixes that
inconsistency.

src/libstrongswan/credentials/credential_manager.c

@@ -806,6 +806,13 @@ static bool verify_trust_chain(private_credential_manager_t *this,
 				call_hook(this, CRED_HOOK_NO_ISSUER, current);
 				if (trusted)
 				{
+					if (!check_lifetime(this, current,
+										current != subject ? "issuer" : "subject",
+										pathlen, FALSE, auth))
+					{
+						trusted = FALSE;
+						break;
+					}
 					DBG1(DBG_CFG, "  reached end of incomplete trust chain for "
 						 "trusted certificate \"%Y\"",
 						 subject->get_subject(subject));