ML-KEM: X.509 private keys

[vcsjones]

This adds X509Certificate2.GetMLKemPrivateKey and X509Certificate2.CopyWithPrivateKey(MLKem). Additionally, this enlightens X509Certificate2.CreateFromPem and some of its related functions to support importing PEM aggregates of certificates and ML-KEM PKCS#8 keys.

Contributes to #113508.

[dotnet-issue-labeler]

Note regarding the new-api-needs-documentation label:

This serves as a reminder for when your PR is modifying a ref *.cs file and adding/modifying public APIs, please make sure the API implementation in the src *.cs file is documented with triple slash comments, so the PR reviewers can sign off that change.

[dotnet-issue-labeler]

Note regarding the new-api-needs-documentation label:

This serves as a reminder for when your PR is modifying a ref *.cs file and adding/modifying public APIs, please make sure the API implementation in the src *.cs file is documented with triple slash comments, so the PR reviewers can sign off that change.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull Request Overview

This PR introduces support for ML-KEM private keys in X509Certificate2 by adding GetMLKemPrivateKey and CopyWithPrivateKey(MLKem) along with corresponding tests and test data updates. Key changes include:

• New APIs and error handling paths for ML-KEM private key extraction and association.
• Updated test coverage in multiple test files to validate ML-KEM PEM import/export and key matching.
• Adjustments in underlying PAL and implementation classes across platforms to support or explicitly reject ML-KEM operations.

Reviewed Changes

Copilot reviewed 14 out of 15 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
X509Certificate2PemTests.cs	Added new tests for CreateFromPem and CreateFromEncryptedPem with ML-KEM keys; modified AssertKeysMatch.
PrivateKeyAssociationTests.cs	Added ML-KEM specific tests for certificate private key association.
CertTests.cs	Added tests to validate exporting ML-KEM private keys.
X509Certificate2.cs	Introduced ML-KEM API methods and updated key extraction methods to include ML-KEM.
OpenSslX509CertificateReader.cs, ICertificatePal.cs, CertificatePal.Windows.PrivateKey.cs, AppleCertificatePal.cs, AndroidCertificatePal.cs	Added ML-KEM support (or explicit not supported exceptions) in platform-specific implementations.
MLKemImplementation.*	Updated ML-KEM implementations and test data to support the new ML-KEM functionality.

Files not reviewed (1)

• src/libraries/System.Security.Cryptography/src/System.Security.Cryptography.csproj: Language not supported