test: Fix the certificate mock scoping and cover the signing surface

[tablackburn]

Closes #216. Closes #217.

What was wrong

Six Mock Get-ChildItem statements in tests/Get-PSBuildCertificate.tests.ps1 had no
-ModuleName, so they never reached the call Get-PSBuildCertificate makes from inside the
module. Three of the tests they backed asserted that the real certificate store was empty: green
on CI and on any workstation without a code-signing certificate, red on a maintainer's machine.
Reproduced first: Should -Invoke Get-ChildItem -Times 0 -Exactly passed while a module-scoped
spy recorded the one real call, and a certificate stood into the store turned the test red.

Invoke-PSBuildModuleSigning had eleven passing tests and none of them called it. Its two
file-discovery tests called Get-ChildItem in the test body and counted the results, which
asserts a fact about PowerShell rather than about this module.

What changed

Certificate tests. The six mocks are module-scoped, following the SkipValidation context
from #194. The three store tests now return an expired certificate, a certificate with no private
key, and a certificate whose thumbprint is not the one asked for, so each exercises the filter it
is named after; two tests cover what none of them did, a store that does hold a usable
certificate.

The post-load validation block — private key, expiry, Code Signing extended key usage — runs for
the first time, driven by objects carrying the properties the function reads. Generated
certificates cannot do this job: EnhancedKeyUsageList comes from PowerShell's own type data, and
one and the same generated certificate reports the Code Signing usage on Windows PowerShell 5.1
and an empty list on PowerShell 7.

Three guard clauses that had never run are covered too: the empty thumbprint, the unset
environment variable, and the Store source's refusal to run off Windows.

One module change. The EnvVar and PfxFile sources constructed an X509Certificate2
directly, and a constructor is not a command, so nothing could stand in for it — which is why the
validation after it had never executed. Private/Import-PSBuildX509Certificate.ps1 names that
load as a command: same two overloads, same exceptions left to propagate, and the password passed
only when the environment variable held one, since no password and an empty one are not the same
thing to the PFX loader. No behaviour change for consumers.

Signing tests. The two misnamed tests are replaced by tests that call the function with
Set-AuthenticodeSignature mocked inside the module: the search recurses, the Include patterns
filter, the certificate, timestamp server, and hash algorithm reach the signing cmdlet rather than
being accepted and dropped, the defaults are the documented ones, and a signature comes back per
file. One Windows-only test signs for real against a self-signed certificate created for the run
and removed from the store in AfterAll however the tests end; it passes an empty timestamp
server so the suite stays off the network. Platform guards use
-Skip:($null -ne $IsWindows -and -not $IsWindows) from #197, and its mirror for the one
non-Windows test.

Coverage and verification

File	Before	After
Get-PSBuildCertificate.ps1	65 of 95	97 of 99
Invoke-PSBuildModuleSigning.ps1	5 of 17	17 of 17
Import-PSBuildX509Certificate.ps1	—	3 of 3

The five instructions covered before in Invoke-PSBuildModuleSigning were its ValidateScript,
which runs at parameter binding; its body was at zero. The two still missed in
Get-PSBuildCertificate are the non-Windows throw, covered on the Linux and macOS legs.

./build.ps1 -Task Test is green on PowerShell 7.6.5 / Windows: 611 passed, 0 failed, 4 skipped
(the fourth is the new non-Windows test), up from 591, and 27.6% to 31.4% overall. No new
PSScriptAnalyzer findings. Cert:\CurrentUser\My was checked after every run and holds nothing
the tests created. The real-signing path was run under Windows PowerShell 5.1 directly and behaves
the same; Pester 6 is not installed for 5.1 here, so that leg is left to CI.

No CHANGELOG.md entry: this is the test suite, and the module change is an internal seam with no
user-facing behaviour change.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

Test Results

    4 files  ± 0    901 suites  +12   2m 28s ⏱️ -1s
  617 tests +21    614 ✅ +21   3 💤 ± 0  0 ❌ ±0 
2 451 runs  +84  2 357 ✅ +62  94 💤 +22  0 ❌ ±0 

Results for commit 1a597ec. ± Comparison against base commit 3ea9e82.

This pull request removes 2 and adds 23 tests. Note that renamed tests count towards both.

Code Signing Functions.Invoke-PSBuildModuleSigning.Searches for files matching Include patterns
Code Signing Functions.Invoke-PSBuildModuleSigning.Uses custom Include patterns when specified

Code Signing Functions.Get-PSBuildCertificate.EnvVar mode.Throws when the environment variable holds nothing
Code Signing Functions.Get-PSBuildCertificate.Store mode.Returns a valid certificate that the store does hold
Code Signing Functions.Get-PSBuildCertificate.Store mode.Throws where there is no certificate store to search
Code Signing Functions.Get-PSBuildCertificate.Thumbprint mode.Returns the certificate whose thumbprint was asked for
Code Signing Functions.Get-PSBuildCertificate.Thumbprint mode.Throws when the thumbprint is empty
Code Signing Functions.Get-PSBuildCertificate.Validation of a certificate loaded from EnvVar or PfxFile.Applies the same validation to a certificate loaded from a PFX file
Code Signing Functions.Get-PSBuildCertificate.Validation of a certificate loaded from EnvVar or PfxFile.Hands the decoded payload and the password from the environment to the loader
Code Signing Functions.Get-PSBuildCertificate.Validation of a certificate loaded from EnvVar or PfxFile.Returns a certificate loaded from a PFX file that passes every check
Code Signing Functions.Get-PSBuildCertificate.Validation of a certificate loaded from EnvVar or PfxFile.Returns a certificate that passes every check
Code Signing Functions.Get-PSBuildCertificate.Validation of a certificate loaded from EnvVar or PfxFile.Returns an unusable certificate when SkipValidation is set
…