crypt32: Only permit v1 or v2 CA certificates without a basic constraints extension if they're installed locally.