security: fix CVE-2023-29409 [1.20 backport]

[gopherbot]

@neild requested issue #61460 to be considered for backport to the next 1.20 minor release.

@gopherbot please open backport issues

[gopherbot]

Change https://go.dev/cl/514900 mentions this issue: [release-branch.go1.20] crypto/tls: restrict RSA keys in certificates to <= 8192 bits

[gopherbot]

Closed by merging 659f2a2 to release-branch.go1.20.

[johanbrandhorst]

This issue is not showing up under the 1.20.7 milestone linked from the release history page because it has the label CherryPickCandidate rather than CherryPickApproved. Does that need to be manually fixed?

[dmitshur]

Thanks for reporting that. This security backport was approved, but marking it as such was missed. I've raised it with the security team to improve the process for the future. Applying it manually retroactively.