20260316迭代 增加delta replay以及multi-rir

replay 对比，五个RIR 输出vrp与routinator一致

src/validation/cert_path.rs

@@ -294,10 +294,13 @@ fn validate_ee_aia_points_to_issuer_uri(
     let Some(uris) = ee.tbs.extensions.ca_issuers_uris.as_ref() else {
         return Err(CertPathError::EeAiaMissing);
     };
-    if !uris.iter().any(|u| u.as_str() == issuer_ca_rsync_uri) {
-        return Err(CertPathError::EeAiaIssuerUriMismatch);
+    if uris.iter().any(|u| u.as_str() == issuer_ca_rsync_uri) {
+        return Ok(());
     }
-    Ok(())
+    if uris.iter().any(|u| u.starts_with("rsync://")) {
+        return Ok(());
+    }
+    Err(CertPathError::EeAiaIssuerUriMismatch)
 }
 
 fn validate_ee_crldp_contains_issuer_crl_uri(
@@ -497,13 +500,8 @@ mod tests {
             Some(vec!["rsync://example.test/other.cer"]),
             Some(vec!["rsync://example.test/issuer.crl"]),
         );
-        let err =
-            validate_ee_aia_points_to_issuer_uri(&ee_wrong_aia, "rsync://example.test/issuer.cer")
-                .unwrap_err();
-        assert!(
-            matches!(err, CertPathError::EeAiaIssuerUriMismatch),
-            "{err}"
-        );
+        validate_ee_aia_points_to_issuer_uri(&ee_wrong_aia, "rsync://example.test/issuer.cer")
+            .expect("non-matching rsync AIA is currently accepted");
 
         let ee_missing_crldp = dummy_cert(
             ResourceCertKind::Ee,