AD CS ESC6: CA Allows SAN Request Attributes

ESC6 is the CA-level misconfiguration where EDITF_ATTRIBUTESUBJECTALTNAME2 is enabled. It allows requesters to supply SAN values through request attributes for certificates issued from templates published by that CA, even when a template does not enable enrollee-supplied subject. Exploitation still requires effective enrollment rights and a suitable authentication-capable template. The flag alone does not guarantee that a certificate can impersonate another account: the SID security extension and current domain-controller strong-mapping policy can prevent that mapping. Scenarios involving ESC9 or ESC16 are separate combined conditions and must be assessed separately.