hold ref to temp keychain on OSX to avoid premature cleanup

[wfurt]

This is fix for issue originally reported on macOS 11.0 when we fail to add certificates to a store.
The root cause if fact that when importing, we put certificate and key to temporary keyChain and that can be deleted before we use the bits. This used to work with 3.1 but it is failing now on Catalina+.

The fix is to grab reference when temporary keychain is used to make sure keychain file stays around.
Since the chain can now linger longer, all the changes in CreateTemporaryKeychain are to ensure we have better one time encryption password. Technically, that is not needed to avoid the issue.

As far as testing, this is little bit tricky. We already have tests that would expose the behavior.
However, the X509StoreMutableTests are guarded by PermissionsAllowStoreWrite.
With the bug adding to store fails and the tests therefore do not run.
I think improving detection of SSH with combination of kPOSIXErrorBase may be long term fix.
Alternatively, we can create new Keychain for the test so it is always writable independently of the the default one.
For now, I verified that the tests run again when keychain is unlocked and the repro code runs on 10.15 & 11.0

fixes #39603

[Dotnet-GitSync-Bot]

I couldn't figure out the best area label to add to this PR. If you have write-permissions please help me learn by adding exactly one area label.

[ghost]

Tagging subscribers to this area: @bartonjs, @vcsjones, @krwq
See info in area-owners.md if you want to be subscribed.

[vcsjones]

Did you confirm that the temp keychain files are getting cleaned up when the cert is disposed, or is that tested somewhere?

[wfurt]

yes, I did. I modified you repro and added ReadLine after the import and added dispose followed by another ReadLine.
And the file is gone after dispose. I did not check any more complicated case when somebody would for example get and ref certificate handle or do some other tricks.

[GrabYourPitchforks]

Will let somebody more familiar with Apple Crypto sign off. But the modified logic in CreateTemporaryKeychain looks good to me!

[wfurt]

/backport to release/5.0-rc2

[github-actions]

Started backporting to release/5.0-rc2: https://github.com/dotnet/runtime/actions/runs/239878923