Fix "invalid handle" failure in X509Cert's copy ctor on macOS

The certificate being copied from could be eligible for collection after its raw IntPtr handle is accessed but before the copy ctor actually gets around to reading from it, leading to use after free and recycling problems.  The fix is simply to ensure the other certificate can't be collected until after we're done using the raw handle.

Author: stephentoub

src/System.Security.Cryptography.X509Certificates/src/Internal/Cryptography/Pal.OSX/CertificatePal.cs

@@ -59,7 +59,9 @@ public static ICertificatePal FromOtherCert(X509Certificate cert)
         {
             Debug.Assert(cert.Pal != null);
 
-            return FromHandle(cert.Handle);
+            ICertificatePal pal = FromHandle(cert.Handle);
+            GC.KeepAlive(cert); // ensure cert's safe handle isn't finalized while raw handle is in use
+            return pal;
         }
 
         public static ICertificatePal FromBlob(