Implement X.509, PKCS#12 and PKCS#8 for ML-KEM

[vcsjones]

Windows now supports encrypted exports for ML-KEM PKCS#8, as well as PKCS#12. Let's remove our work around and enable the tests.

The changes and implementation here are more or less a straight port of ML-DSA's.

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).
13 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @bartonjs, @vcsjones, @dotnet/area-system-security
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

This PR enables Windows support for ML-KEM X.509 private key association and key export scenarios (PKCS#8 and PKCS#12), and updates tests to run on Windows when ML-KEM is supported.

Changes:

• Enable Windows certificate private-key association for ML-KEM (GetMLKemPrivateKey/CopyWithPrivateKey) using CNG and PKCS#8 import/export paths.
• Add ML-KEM Windows implementation plumbing to create ephemeral CNG keys and support encrypted-only export scenarios.
• Remove the Windows-exclusion test gate and update/expand ML-KEM X.509/PKCS#12 test coverage accordingly.

Show a summary per file

File	Description
src/libraries/System.Security.Cryptography/tests/X509Certificates/X509Certificate2PemTests.cs	Run ML-KEM PEM load tests based on MLKem.IsSupported (includes Windows).
src/libraries/System.Security.Cryptography/tests/X509Certificates/PfxTests.cs	Run ML-KEM PKCS#12/PFX import tests based on MLKem.IsSupported.
src/libraries/System.Security.Cryptography/tests/X509Certificates/ExportTests.cs	Run ML-KEM PKCS#12 roundtrip export test based on MLKem.IsSupported.
src/libraries/System.Security.Cryptography/tests/X509Certificates/CertTests.cs	Enable ML-KEM CopyWithPrivateKey/ExportPrivate tests on Windows.
src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/X509Certificates/CertificatePal.Windows.PrivateKey.cs	Implement ML-KEM private key retrieval and CopyWithPrivateKey on Windows.
src/libraries/System.Security.Cryptography/src/System.Security.Cryptography.csproj	Include new ML-KEM CNG creation helper source file.
src/libraries/Microsoft.Bcl.Cryptography/src/System/Security/Cryptography/X509Certificates/X509CertificateKeyAccessors.cs	Add Windows-only implementations for ML-KEM key accessors outside NET / NETSTANDARD.
src/libraries/Microsoft.Bcl.Cryptography/src/Microsoft.Bcl.Cryptography.csproj	Include new ML-KEM CNG creation helper source file.
src/libraries/Common/tests/System/Security/Cryptography/X509Certificates/CertificateCreation/PrivateKeyAssociationTests.Shared.cs	Update ML-KEM certificate association assertions to validate functional decapsulation.
src/libraries/Common/tests/System/Security/Cryptography/PlatformSupport.cs	Remove IsPqcMLKemX509Supported (Windows exclusion) gate.
src/libraries/Common/tests/System/Security/Cryptography/MLKemCngTests.Windows.cs	Adjust ML-KEM CNG tests for PKCS#8 behavior and expected Windows error codes.
src/libraries/Common/tests/System/Security/Cryptography/MLKemBaseTests.cs	Centralize “export PKCS#8 from public key” assertions via a virtual helper.
src/libraries/Common/src/System/Security/Cryptography/X509Certificates/CertificateHelpers.Windows.cs	Add ML-KEM CopyWithPrivateKey implementation on Windows, including CNG/PKCS#8 import fallback.
src/libraries/Common/src/System/Security/Cryptography/MLKemImplementation.CreateCng.cs	New helper to create an ephemeral CngKey from MLKemImplementation key material.
src/libraries/Common/src/System/Security/Cryptography/MLKemCng.Windows.cs	Implement PKCS#8 import and support encrypted-only export workflows for ML-KEM keys.
src/libraries/Common/src/System/Security/Cryptography/MLDsaCng.Windows.cs	Reuse shared Helpers.TrimAndTrack utility.
src/libraries/Common/src/System/Security/Cryptography/Helpers.cs	Add shared TrimAndTrack helper for safe trimming/clearing of key material arrays.

Review details

• Files reviewed: 17/17 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

Review details

• Files reviewed: 18/18 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

Review details

• Files reviewed: 18/18 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

Copilot review overview

Review tier: Lite
Findings: None

[vcsjones]

Seems like our CI images have not had ML-KEM flow down through servicing yet. Will Re-open when I get better information about PKCS#8 exports from ncrypt.