IMDSv2 mTLS PoP: add best‑effort persisted binding‑cert cache (Windows CurrentUser\My) layered over in‑memory cache; per‑alias mutex; tests

[gladjohn]

Fixes - Adds MSI v2 cert to the store (persistent cache)

Changes proposed in this request
The IMDSv2 mTLS PoP flow currently relies only on a process‑local cache. That means new processes (or app restarts) must re‑mint the binding certificate even when a valid one already exists on the machine. This PR layers a best‑effort, cross‑process persisted cache on top of the existing in‑memory cache to reduce reminting, while keeping token acquisition robust (never blocked by persistence).

Testing
unit testing

Performance impact
none

Documentation

• All relevant documentation is updated.

[bgavrilMS]

Are you overusing static? Everything seems static in this design. Does this not need mocking? And a logger?

[gladjohn]

we don't need mocking here, but made few changes.

[Robbie-Microsoft]

Can we use dependency injection instead of putting this in the constructor? This should enhance testability.

[Robbie-Microsoft]

Can you create a named tuple?

internal class MtlsBindingInfo
{
    public X509Certificate2 Certificate { get; set; }
    public string Endpoint { get; set; }
    public string ClientId { get; set; }
}

[Robbie-Microsoft]

what if an exception occurs before the using block exposes?

[Robbie-Microsoft]

can you add a log here?

[Robbie-Microsoft]

should we log duration waited?

[Robbie-Microsoft]

Why is there a difference in string comparison between conditional and unconditional CNs? (Ordinal vs. OrdinalIgnoreCase)

[Robbie-Microsoft]

can you add additional tests:

• Edge cases:
  • Invalid or null alias values to ensure proper exception handling or fallback.
  • Very long alias strings to check for buffer overflows or system limitations.
  • Non-Windows platforms
• Multiple concurrent attempts
• Exception handling within action: Add tests where the action delegate throws an exception—confirm lock is released and exception bubbles as expected.

[Robbie-Microsoft]

please use global/local for readability

[Robbie-Microsoft]

can you add additional tests:

• for non-windows behavior, validate intended no-op/error/alternative behavior
• Add tests to validate behavior when mutex acquisition fails due to errors besides contention (e.g., invalid alias, OS failures), or when the action throws an exception—does the lock get released?
• Test that repeated calls for the same alias succeed serially—i.e., after the first lock is released, the second can acquire.
• Test boundary and edge cases for aliases: empty string, extremely long name, special characters, unicode, etc.

[Robbie-Microsoft]

Use private helper methods to reduce repeated code for Windows checks or lock calls