fix: handle hex.DecodeString error in FormatOID() instead of silently discarding

[srpatcha]

Fix silently ignored hex decode error in certificate subject parsing

Problem

FormatOID() in x/pki/x509/x509.go silently discards the error from hex.DecodeString(). When a malformed hex string is encountered in a certificate subject field, the function produces corrupt output instead of signaling an error. In a compliance ledger, this is a security concern as it can mask certificate tampering or corruption.

Root Cause

Line 156: decoded, _ := hex.DecodeString(value) uses the blank identifier to discard the error. If value contains non-hex characters, decoded will be an incomplete or empty byte slice, and the resulting subject field will contain corrupt data that is silently accepted into the ledger.

Fix

Changed to decoded, err := hex.DecodeString(value) with an if err != nil { continue } guard. Malformed entries are now skipped rather than producing corrupt output, preserving the original subject value.

Testing

• Submit a certificate with a malformed hex string in the subject OID field.
• Previously: corrupt subject stored silently. Now: malformed entry skipped.
• Valid hex strings continue to decode correctly.

Impact

Affects all users of the distributed compliance ledger's PKI module. Malformed certificates could have corrupt subject fields stored without any error indication.