fix der_length_object_identifier()

... there are only three root nodes

As of X6.90 Ch. 8.19.4: "NOTE – This packing of the first two
object identifier components recognizes that only three values
are allocated from the root node..."

src/pk/asn1/der/object_identifier/der_length_object_identifier.c

@@ -48,8 +48,8 @@ int der_length_object_identifier(const unsigned long *words, unsigned long nword
       return CRYPT_INVALID_ARG;
    }
 
-   /* word1 = 0,1,2,3 and word2 0..39 */
-   if (words[0] > 3 || (words[0] < 2 && words[1] > 39)) {
+   /* word1 = 0,1,2 and word2 0..39 */
+   if (words[0] > 2 || (words[0] < 2 && words[1] > 39)) {
       return CRYPT_INVALID_ARG;
    }