I had this error:
```
!!! --- Unexpected TLS failure --- !!!
CertificateException: Certificate chain does not conform to required transparency policy: NOT_ENOUGH_SCTS
Thrown by com.android.org.conscrypt.ct.CertificateTransparency->checkCT
[ ] Unrecognized TLS error - this must be patched manually
```
This patch fixes it.
This doesn't matter much for anonymous module cases AFAICT, but when the
module is loaded normally by name (on real devices, not emulators I
think) then the range can include some protected non r-x ranges, which
we can't scan. This ensures we only scan possible code ranges.
Previously this blocked all reads of any paths containing 'su', which
has a lot of false positives (e.g. .../support-file) that will very
plausibly cause problems.
We previously left this in, since it's generally better to follow TLS
rules, but there's one case where it matters: when a client sends a
request without using SNI, and so the proxy may not show the right
certificate. We want to allow that, and to do so we need to ensure that
hostname checks are skipped (but only for our CA - not for any others,
which must still follow normal TLS rules).
This avoids the potential for bugs (calling the method directly does
dynamic lookup based on argument types, which may not match the called
method in ambiguous cases, e.g. int vs double are indistinguishable in
JS) and improves performance (skipping any dynamic method lookup).
Tim Perry