Allow signing intermediate CA

[Trojan295]

I was trying to set up an intermediate CA on Vault, while using the mkcert as root CA. Unfortunately, I see there is no such feature built in and trying to use openssl to sign the intermediate CSR fails, as the pathlen constraint is set to zero, which means no intermediate CA can be in between.

Do you think such feature could be added? I'm willing to implement this (allow non-zero pathlen in the mkcert root CA cert).