Test fixtures have duplicate x509 extension

[wagoodman]

What happened:
When running unit tests with go 1.20 I see the following failure:

--- FAIL: TestSign (2.92s)
    --- FAIL: TestSign/sign_the_syft_binary_(with_a_password) (0.00s)
        sign_test.go:197: 
                Error Trace:    /Users/wagoodman/code/quill/quill/sign_test.go:197
                Error:          Received unexpected error:
                                unable to parse certificate 1 of 1: x509: certificate contains duplicate extensions
                Test:           TestSign/sign_the_syft_binary_(with_a_password)
FAIL

We're on go 1.18 now, bumping to 1.20 you will be able to see the same thing locally.

What you expected to happen:
No test failures!

How to reproduce it (as minimally and precisely as possible):
make unit while using go 1.20.

Anything else we need to know?:
More details on the current change in behavior for x509 certificate verification https://groups.google.com/g/golang-checkins/c/nishT5TtWeo .