Make CertificateRequest et al work with ML-DSA

[bartonjs]

A few things happen in this PR:

• CRL Builder Tests now run for every supported signing algorithm
• CopyWithPrivateKey was under-tested for all algorithms (particularly around the exception model), that has been rectified
• Our test CertificateAuthority class gained algorithm agility
  • On my system where MLDsa.IsSupported reports true, I changed the default key algorithm from RSASSA-2048+SHA-2-256 to ML-DSA-65, and everything passed.

Those pieces could be broken out into a pure test enhancement change for cleanliness.

The impetus of the change, however, was to add first-class support for ML-DSA to CertificateRequest.

• Add ctors to CertificateRequest
• Enlighten CertificateRequest that future signing algorithms might not require a HashAlgorithmName
• Add support to CertificateRequestListBuilder
• Add cert.GetMLDsaPublicKey/GetMLDsaPrivateKey/CopyWithPrivateKey to power the above.

Contributes to #113502

[ghost]

Note regarding the new-api-needs-documentation label:

This serves as a reminder for when your PR is modifying a ref *.cs file and adding/modifying public APIs, please make sure the API implementation in the src *.cs file is documented with triple slash comments, so the PR reviewers can sign off that change.

[ghost]

Note regarding the new-api-needs-documentation label:

This serves as a reminder for when your PR is modifying a ref *.cs file and adding/modifying public APIs, please make sure the API implementation in the src *.cs file is documented with triple slash comments, so the PR reviewers can sign off that change.

[Copilot]

Copilot reviewed 26 out of 29 changed files in this pull request and generated 2 comments.

Files not reviewed (3)

• src/libraries/System.Security.Cryptography/ref/System.Security.Cryptography.csproj: Language not supported
• src/libraries/System.Security.Cryptography/src/Resources/Strings.resx: Language not supported
• src/libraries/System.Security.Cryptography/src/System.Security.Cryptography.csproj: Language not supported

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

[bartonjs]

Looks like I forgot to try to build System.Net.Security.Tests, which also includes CertificateAuthority.cs

[vcsjones]

Should this be added to Dispose like _privateKey?

[vcsjones]

XML docs?

[vcsjones]

Docs would be good.

[bartonjs]

The longer the PR has been up, the more dirty I feel about a huge passel of test/infrastructure changes and the "enable ML-DSA" part. Partially because the "enable ML-DSA" part is supposed to serve as a template for SLH-DSA and CompositeMLDsa... so I think I'm going to break this into two pieces, even though that's more work.