go: crypto/x509: gate marshaling of Policies on a GODEBUG [freeze exception]

#60665 introduced a new OID type and a new field on the Certificate.

This change might cause a slight backwards compatibility breakage, it was not discussed there, so it might be worth discussing it here again.

Consider https://go.dev/play/p/Z92_1DOZJQi?v=gotip

func TestParsedCertificateAsTemplate(t *testing.T) {
	b, _ := pem.Decode([]byte(largeOIDPEM))
	if b == nil {
		t.Fatalf("couldn't decode test certificate")
	}
	template, err := x509.ParseCertificate(b.Bytes)
	if err != nil {
		t.Fatalf("ParseCertificate unexpected error: %v", err)
	}
	template.PublicKey = nil

	// Clear all PolicyIdentifiers from template.
	template.PolicyIdentifiers = nil

	newCertDER, err := x509.CreateCertificate(rand.Reader, template, template, rsaPrivateKey.Public(), rsaPrivateKey)
	if err != nil {
		t.Fatalf("CreateCertificate unexpected error: %v", err)
	}

	cert, err := x509.ParseCertificate(newCertDER)
	if err != nil {
		t.Fatalf("ParseCertificate unexpected error: %v", err)
	}

	if len(cert.PolicyIdentifiers) != 0 {
		t.Fatalf("PolicyIdentifiers field is not empty") // fails on gotip
	}
}

This does not fail on go 1.21, but on gotip it fails. I am not sure whether we should be concerned about this. Not sure whether (and why) someone might be using a parsed certificate as a template, but who knows.

CC @rolandshoemaker