Required issuer policy for certificate signing.
The caller owns this structure and its callback context for the duration of the signing call. type is a U8 SHARKSSL_CERT_PROFILE_* value. pathLenConstraint is U16: supply an explicit CA depth for a CA profile and 0xFFFF for a leaf. approveSANs receives the borrowed void *context, a borrowed array of SharkSslCertSAN records, and a U16 count. It returns int: zero accepts every requested name; nonzero rejects issuance. Leaf issuance requires the callback to enforce the authorized enrollment identity. CSR-backed name bytes remain valid only during the call and must not be retained.