Preserve CA path-length constraints when importing PEM

[AryanRG]

CA.from_pem() currently leaves the cached path length at the constructor default of 9. For example, importing a CA with path_length=0 lets it create a child even though the original CA refuses, producing a chain that exceeds the root’s constraint.

Restore the cached limit from the imported certificate’s Basic Constraints and propagate None when creating children of an unlimited CA. Preserve the existing default when the extension is absent. Add regressions for finite/unlimited limits and the absent-extension fallback; that fallback test checks compatibility, not certificate validity.

Local validation on macOS / CPython 3.14.4:

• 34 tests passed with warnings treated as errors; 100% statement/branch coverage.
• New regression cases against pristine base: 4 failed, 2 passed.
• Black and isort checks passed.
• Strict mypy reports an unused type: ignore on tests/test_trustme.py:12, also reproduced on pristine base. Mypy passes with only unused-ignore diagnostics disabled.

The multi-platform/Python matrix has not been run locally. Hosted CI results remain pending. Includes newsfragments/727.bugfix.rst.