The new certificate loader only loads one data type per method, unlike
the previous loader mechanism (new X509Certiicate2(bytes, ...)).  It also
allows for caller configuration to control cost-of-work limits and some
common usability gotchas around Windows PFX loading.

This change adds the new loader, and changes the X509Certificate2 ctors
to use it; a followup will mark the ctors as Obsolete and update usage in
the dotnet/runtime codebase.

For one, the code as written lost the attributes it should have preserved.
For two, the swapped in attribute might be important.