crypto: fix use-after-free risk in ManagedX509 assignment

[omghante]

Description

This PR resolves a potential double-free/use-after-free vulnerability identified by Coverity (Issue 367349) within ManagedX509::operator=.

Previously, cert_.reset(that.get()) was destructing the underlying X509 structure prior to correctly tracking the reference count out-of-band via X509_up_ref(cert_.get()). If multiple ManagedX509 instances mistakenly managed the same underlying raw pointer, it could cause the OpenSSL backing object's internal reference count to reach zero and prematurely free the memory before up_ref executes.

The refactored logic now ensures strict adherence to OpenSSL smart pointer semantics:

• Added a self-assignment check to return early.
• Guarantees X509_up_ref(cert) increments the reference limits first before the object acts on .reset(), strictly guaranteeing the memory boundary.

Fixes: #56926

[nodejs-github-bot]

Review requested:

• @nodejs/crypto

[codecov]

Codecov Report

❌ Patch coverage is 0% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 89.69%. Comparing base (ed05549) to head (9da6f80).
⚠️ Report is 1511 commits behind head on main.

Files with missing lines	Patch %	Lines
src/crypto/crypto_x509.cc	0.00%	5 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #62742      +/-   ##
==========================================
- Coverage   89.69%   89.69%   -0.01%     
==========================================
  Files         706      706              
  Lines      218127   218130       +3     
  Branches    41734    41739       +5     
==========================================
- Hits       195651   195641      -10     
- Misses      14400    14419      +19     
+ Partials     8076     8070       -6     

Files with missing lines	Coverage Δ
src/crypto/crypto_x509.cc	72.13% <0.00%> (-0.32%)	⬇️

... and 47 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[omghante]

Gentle ping - this PR has been open for ~3 weeks without review.

This fixes the Coverity 367349 use-after-free risk in ManagedX509::operator=
(#56926) by ensuring X509_up_ref runs before cert_.reset(), with a
self-assignment guard. It's a minimal, 1-file, 6-line net change.

CI is green and the fix is ready for review. Would anyone from the crypto
team be able to take a look?

@targos (as the issue author) @tniessen @panva would appreciate your
eyes on this when you get a chance. Thank you!

[github-actions]

This pull request has been marked as stale due to 90 days of inactivity.
It will be automatically closed in 30 days if no further activity occurs. If this is still relevant, please leave a comment or update it to keep it open.

[omghante]

Keep this open

[trivikr]

@omghante Can you please rebase from main?