Change the Unix cert store to store certificates with AES256+SHA256 PBES2

[vcsjones]

Today, we store certificates on-disk with Linux that result in 3DES and SHA1 being used. If you are on a FIPS-constrained environment, OpenSSL will fail to be able to read and write to a certificate store.

This changes the Unix stores to use AES256+SHA256 using the new ExportPkcs12 API. Since we have more control over the export now, this also allows using a single round for the KDFs. We don't need 2000 rounds since a null password is used.

Fixes #111560

PR Overview

This PR updates the Unix certificate store to use AES256+SHA256 PBES2 by leveraging the new ExportPkcs12 API, thereby replacing the legacy 3DES and SHA1 encryption. Key changes include:

• Adding two new unit tests to verify the updated PBE parameters and ensure backwards compatibility with legacy encrypted certificates.
• Updating the OpenSslDirectoryBasedStoreProvider to use ExportPkcs12 with AES256+SHA256 and a reduced iteration count.

Reviewed Changes

File	Description
src/libraries/System.Security.Cryptography/tests/X509Certificates/X509FilesystemTests.Unix.cs	Added unit tests to verify correct encryption parameters in certificate store operations
src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/X509Certificates/OpenSslDirectoryBasedStoreProvider.cs	Refactored certificate export logic to utilize the new ExportPkcs12 API with updated PBE parameters

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

Tip: If you use Visual Studio Code, you can request a review from Copilot before you push from the "Source Control" tab. Learn more

[vcsjones]

/azp run runtime-libraries-coreclr outerloop-linux

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[vcsjones]

New tests passed in outerloop. Merging.