Fix zlib cert decompression by ignoring EOF

[hwh33]

An io.Reader is allowed (but not required) to return io.EOF upon reading the
last byte of the stream, even if no subsequent bytes were requested. We later
check that we read the expected number of bytes, so we can safely ignore EOF
errors returned by the decompression readers.

[hwh33]

Fixes #205

Thanks for calling attention to the issue @yan-foto and @felipe-linares - also for the fix suggestion, which turned out to be correct.

[hwh33]

Looks like the same CI failures occur on main right now (and this change should clearly not create any failures as the code path is untested).

[gaukas]

The CI failure is caused by testdata from Go 1.19, since Go 1.20 updated implementations and essentially broke the old per-byte comparison test. The CI for Go 1.20 and 1.21 will pass once we bump up version (perhaps when Go 1.21 becomes stable).