constraints: Add permitted/excludedNameConstraints check