security: harden validation pipeline — boolean parsing, CN matching, hash algorithm policy, API guidance, payload handling, cache keys

[JeromySt]

Security Hardening

Addresses findings from an internal security review of the validation pipeline.

Fixes

GetOptionBool parsed value handling (df542f81)

• Boolean flag parsing now honours the parsed value correctly
• Regression tests added

X509CommonNameValidator equality check (16fc219a)

• CN matching restored to exact equality (regression from PR BugFix: Normalize CommonName Checks #132)
• Regression tests added

Indirect signature hash algorithm policy (b38aa6a1)

• Verify-side hash algorithm restricted to SHA-256/384/512
• Aligns with existing sign-side policy from PR Remove Weak Algorithms #123

CoseSign1MessageValidator.None API guidance (60ff09e2)

• XML documentation corrected to accurately describe behavior
• Added [Obsolete] and [EditorBrowsable(Never)] annotations

GetCommand payload write ordering (fc7ebfe1)

• File write now gated on successful validation result
• Regression tests added

Certificate cache key strengthening (c74b7e79)

• Cache key replaced with cryptographic digest
• Eliminates theoretical collision risk in long-running processes

Each commit includes targeted regression tests.

[JeromySt]

Fixed in 1294aa0 — solution builds no longer re-invoke the plugin projects from CoseSignTool.csproj. We now skip the BuildPlugins target during solution builds, which avoids the concurrent write race on CoseSignTool.AzureArtifactSigning.Plugin.runtimeconfig.json while preserving direct project builds/publish behavior.

[JeromySt]

Addressed @elantiguamsft feedback on CN validator in 7f0bae0:

The original PR #132 intentionally adopted signtool.exe /n substring semantics, but the operand order was inverted — it checked if the pin contained the signer CN instead of the other way around. This meant a signer with CN='o' could match any pin containing 'o' (like 'Microsoft Corporation').

Fix: Corrected to signer-contains-pin order, added 3-char minimum on required CN, and documented signtool.exe /n semantics in XML remarks. Substring matching is preserved while closing the gap.