CVE-2026-63649 - mbedTLS backend ignores x509-username-field

OpenVPN 2.7 using the mbedTLS backend ignores the --x509-username-field configuration and always uses the certificate Common Name, which allows remote authenticated users to potentially be identified as the wrong user or receive incorrect configurations.

Affects versions 2.7_alpha1 through 2.7.5. This is fixed in version 2.7.6.