pv: Restrict CRL downloads to HTTP(S) and limit redirects

Only allow CRL downloads over HTTP and HTTPS to avoid accessing
unexpected protocol handlers.

The Rust curl bindings do not expose support for configuring allowed
protocols or the maximum number of redirects [1][2][3]. Therefore,
redirect handling is implemented manually, validating each redirect
target and enforcing a maximum of five redirects.

The redirect limit also prevents infinite redirect loops.

[1] https://curl.se/libcurl/c/CURLOPT_PROTOCOLS_STR.html
[2] https://curl.se/libcurl/c/CURLOPT_REDIR_PROTOCOLS_STR.html
[3] https://curl.se/libcurl/c/CURLOPT_MAXREDIRS.html

Fixes: c6f621d0dc ("rust: Add library for pv tools")
Assisted-by: IBM Bob:1.0.5
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>

rust/pv/src/error.rs

@@ -173,8 +173,12 @@ pub enum HkdVerifyErrorType {
     IssuerMismatch,
     #[error("No CRL distribution points found")]
     NoCrlDP,
+    #[error("CRL distribution point uses unsupported protocol (only HTTP/HTTPS allowed)")]
+    InvalidCrlProtocol,
     #[error("The IBM Z signing key could not be verified. Error occurred at level {1}")]
     IbmSignInvalid(#[source] openssl::x509::X509VerifyResult, u32),
+    #[error("Too many redirections during CRL download")]
+    TooManyRedirectionsCrlDownload,
     #[error("CRL download failed")]
     CrlDownloadFailed,
 }