Function cn_matches_path_machine_id 

pub async fn cn_matches_path_machine_id(
    __arg0: Path<HashMap<String, String>>,
    request: Request,
    next: Next,
) -> Result<Response, StatusCode>

403 if leaf CN doesn’t match {id}; no-op when extension is absent or empty.