X509: wrongly rejects cert without CDP if CRL contains IDP with name matching cert issuer

When a cert without a CDP extension is validated with CRL checking required where a CRL from the same issuer is available having an IDP extension, the cert is wrongly rejected (with a maybe misleading error: X509_V_ERR_DIFFERENT_CRL_SCOPE).

With the certs and CRLs in demoCA.zip:

openssl verify -attime 1705520210 -trusted cacert.pem -crl_check -CRLfile crl-no-IDP.pem cert-no-CDP.pem 
cert-no-CDP.pem: OK

openssl verify -attime 1705520210 -trusted cacert.pem -crl_check -CRLfile crl-no-IDP.pem cert-with-CDP.pem
cert-with-CDP.pem: OK

openssl verify -attime 1705520210 -trusted cacert.pem -crl_check -CRLfile crl-with-IDP.pem cert-with-CDP.pem
cert-with-CDP.pem: OK

openssl verify -attime 1705520210 -trusted cacert.pem -crl_check -CRLfile crl-with-IDP.pem cert-no-CDP.pem
CN=x509-check-test
error 44 at 0 depth lookup: different CRL scope
error cert-no-CDP.pem: verification failed

RFC 5280 section 6.3.3: CRL Processing essentially says that when checking a cert, for each CDP extension in the cert and for each corresponding CRL, if the CRL has the IDP extension, the IDP must match. Yet what get_crl_score() and crl_crldp_check() in x509_vfy.c (roughly speaking) do is: for each available CRL that has the IDP extension with a distpoint (or has a different issuer), there must be a matching CDP extension in the cert.

BTW, test coverage for CRL use is insufficient.

@vdukhovni, this is the bug I mentioned in https://github.com/openssl/openssl/pull/23043#discussion_r1455039798.