Fixed
- Enforce SPIFFE-spec-compliant URI SAN validation for X.509-SVID leaf certificates (#421)
- Require a non-root SPIFFE ID path for X.509-SVID leaf certificates, per the SPIFFE spec (#417)
- Tighten SPIFFE ID path validation and segment construction to match the SPIFFE spec (#420)
- Parse SPIFFE IDs case-insensitively and normalize trust domains to lowercase in accordance with the SPIFFE spec (#416)