fix LocalCertificateSelectionCallback on unix

[wfurt]

As noted in #52499, on Windows LocalCertificateSelectionCallback can be called twice (or more).
First it is called before handshake with certificate and trustedCA list empty. If server asks for client certificate, handshake will stop with 'CredentialsNeeded' and we would call the callback once again with certificate provided by the server and possibly CA list. All that logic is missing on Linux and that is main reason why the remote certificates and CA list is always empty. We already had fragments of code to deal with the CA list but they were never invoked e.g. it was just dead baggage.

Since both Linux(OpenSSL) and macOS was mechanism how to do it this change brings both to parity with Windows.
I'm not sure if the first invocation before handshake make sense but I decided to keep it for compatibility.
We may improve documentation with note about multiple invocation on single SSL session.

Unlike Windows where this is done via new credentials, both OSes needs to set the certificate on the Ssl session itself.
With OpenSSL we use SSL_set_cert_cb and SslSetBreakOnCertRequested on macOS. That will make the handshake stop with particular error. We call the callback and set certificate on the session if provided by the user.

While we still cannot set and test the CA list on Unix, I added test to verify that the callback is called with real certificate e.g. in middle of SSL handshake.

fixes #52499
contributes to #55802

[ghost]

Tagging subscribers to this area: @dotnet/ncl, @vcsjones
See info in area-owners.md if you want to be subscribed.

Issue Details

---

As noted in #52499, on Windows LocalCertificateSelectionCallback can be called twice (or more).
First it is called before handshake with certificate and trustedCA list empty. If server asks for client certificate, handshake will stop with 'CredentialsNeeded' and we would call the callback once again with certificate provided by the server and possibly CA list. All that logic is missing on Linux and that is main reason why the remote certificates and CA list is always empty. We already had fragments of code to deal with the CA list but they were never invoked e.g. it was just dead baggage.

Since both Linux(OpenSSL) and macOS was mechanism how to do it this change brings both to parity with Windows.
I'm not sure if the first invocation before handshake make sense but I decided to keep it for compatibility.
We may improve documentation with note about multiple invocation on single SSL session.

Unlike Windows where this is done via new credentials, both OSes needs to set the certificate on the Ssl session itself.
With OpenSSL we use SSL_set_cert_cb and SslSetBreakOnCertRequested on macOS. That will make the handshake stop with particular error. We call the callback and set certificate on the session if provided by the user.

While we still cannot set and test the CA list on Unix, I added test to verify that the callback is called with real certificate e.g. in middle of SSL handshake.

fixes #52499
contributes to #55802

Author:	wfurt
Assignees:	wfurt
Labels:	area-System.Net.Security, os-linux, os-mac-os-x
Milestone:	-

[wfurt]

I did more testing and it seems like the remoteCertificate is always null on Windows. We make attempt but it always fails. I open #63321 to track that and I added note to the new test.
This change brings both remoteCertificate and acceptableIssuers on macOS and Linux.
I expect more changes when we implement #55802 and we could actually test the acceptableIssuers.

Conflicts resolved, this should be good for review.