Found by valgrind.

Perhaps IDirectDraw7_CreateSurface() should also always set "pSurface7" to
NULL on failure, but at least for our internal functions that's a silly thing
to rely on.

crypt32: Allow the caller of checkChainPolicyStatus to specify the date to test with and additional policy parameters.

crypt32: Accept either the subject alt name 2 or subject alt name extensions, and prefer the former when both are present.