[iOS] Implement iOS PAL for S.S.C.X509Certificates

[filipnavara]

The managed part is split from the macOS PAL implementation because it's substantially different. The chain building part is kept shared but certificate and store management is implemented from scratch with some code reuse. iOS keychain supports only one store that is exposed as the My store.

Missing features:

• Root certificate store (not exposed by API)
• PKCS [master] Update dependencies from dotnet/coreclr #7 import and export (not exposed by native API, can be added in managed code if deemed necessary)
• Key store flags are ignored on certificate import (marked as TODO, matches current Android behavior)

It passes all the inner and outer loop tests except the ones that are explicitly disabled in the PR and the ones failing because of test runner issue (#52104; fix submitted in #52372).

Fixes #36897.
Fixes #49289.
Fixes #51388.
Contributes to #47910.
Contributes to #47533

[ghost]

Tagging subscribers to this area: @bartonjs, @vcsjones, @krwq, @GrabYourPitchforks
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Builds on top of #52043.

The managed part is split from the macOS PAL implementation because it's substantially different. The chain building part is kept shared but certificate and store management is implemented from scratch with some code reuse. iOS keychain supports only one store that is exposed as the names My store.

Missing features:

• Root certificate store (not exposed by API)
• PKCS [master] Update dependencies from dotnet/coreclr #7 import and export (not exposed by native API, can be added in managed code if deemed necessary)
• Key store flags are ignored on certificate import (marked as TODO, matches current Android behavior)

Marked as draft for the moment to solicit early review.

Fixes #49289.
Contributes to #47910 and #47533

Author:	filipnavara
Assignees:	-
Labels:	area-System.Security
Milestone:	-

[filipnavara]

Rebased after #52043 was merged.

[steveisok]

@bartonjs can you give this another pass?

[bartonjs]

@bartonjs can you give this another pass?

It's on my todo list, currently around third, which probably means tomorrow afternoon.

[bartonjs]

My only "real" concern before merging is the PEM header and content mismatch scenario (oh, and clearing the rented PEM buffer). Removing the highly repetitive triplet of platforms for the skip attributes is just bonus.

[filipnavara]

The one test failure is unrelated. (fixed by re-run) iOS Simulator tests passed on the runtime-staging pipeline.

[filipnavara]

@bartonjs Can you take another look please? I believe I have addressed all the issues you found in your last review.

[steveisok]

@filipnavara thanks for the contribution!

[filipnavara]

Happy to help and to cross it off the list. 😅