Metadata API: SuccinctRoles.is_delegated_role() accepts non-canonical bin names #3033

SuccinctRoles.is_delegated_role() validates the bin suffix with int(suffix, 16). int() also accepts a leading sign, surrounding whitespace, underscores between digits and upper case digits, so with SuccinctRoles([], 1, 5, "bin") the names bin-+f, bin- f, bin-f , bin-0F are reported as delegated (and bin-1_0 with bit_length 12), although get_roles()/get_role_for_target() only ever produce zero-padded lower case names like bin-0f. Targets.get_delegated_role() relies on this check. I'd expect only the exact generated names to be accepted.

I have a fix with tests ready and will open a PR.