Add constraint for authorization list tag ordering

[copybara-service]

Add constraint for authorization list tag ordering

[JesusMcCloud]

Some devices in the field violate this constraint.
Unrelated but

• various devices in the field also violate DER by encoding explicitly encoding critical = false into the attestation extension in the leaf
• various devices in the field encode an ASN.1 boolean as 0x01 instead of 0xFF, also violating DER.

Strictly enforcing ordering (or even ASN.1 SET canonical ordering, which is also sometimes violated) will cause devices to trip checks even though semantically everything is fine.

All these device are GMS-certified and ship with Goole Play services and are somewhat recent (IIRC one is running Android 14). Sadly, I cannot publicly share data to back up my claims.

[carmenyh]

This change adds the option to enforce ordering. It's not setting enforcement as the default.

[JesusMcCloud]

All I am saying is the ability to enable strict checks like those should come with a warning aimed at those integrating the library.