ML-KEM: X509Certificate2.GetMLKemPublicKey

[vcsjones]

This provides an in-box implementation of X509Certificate2.GetMLKemPublicKey().

Originally, this change included the X509CertificateKeyAccessors for Microsoft.Bcl.Cryptography. However, we cannot meaningfully test this until there is a Windows / .NET Framework implementation of MLKem. The unit tests run for either NetCoreAppCurrent, which is .NET 10 and the implementation of X509CertificateKeyAccessors will be "Just call the one on X509Certificate2". The other target for the unit tests is .NET Framework, which would use the downlevel implementation, but we lack a function MLKem on Windows at the moment.

Instead of including a big chunk of untestable code, I decided to hold off on that part, for now.

[ghost]

Note regarding the new-api-needs-documentation label:

This serves as a reminder for when your PR is modifying a ref *.cs file and adding/modifying public APIs, please make sure the API implementation in the src *.cs file is documented with triple slash comments, so the PR reviewers can sign off that change.

[ghost]

Note regarding the new-api-needs-documentation label:

This serves as a reminder for when your PR is modifying a ref *.cs file and adding/modifying public APIs, please make sure the API implementation in the src *.cs file is documented with triple slash comments, so the PR reviewers can sign off that change.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull Request Overview

This PR introduces an in-box implementation of X509Certificate2.GetMLKemPublicKey(), exposing the new ML-KEM API and adding the corresponding reflection metadata and unit tests.

• Implements GetMLKemPublicKey with proper XML documentation and experimental attributes.
• Updates the reference assembly to expose the new API.
• Adds unit tests and test data for various ML-KEM certificate scenarios.

Reviewed Changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 1 comment.

File	Description
src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/X509Certificates/X509Certificate2.cs	Adds the new GetMLKemPublicKey() implementation with experimental support.
src/libraries/System.Security.Cryptography/ref/System.Security.Cryptography.cs	Updates the public contract to include GetMLKemPublicKey().
src/libraries/Common/tests/System/Security/Cryptography/X509Certificates/MLKemCertTests.cs	Provides tests for the new ML-KEM API under different conditions.
src/libraries/Common/tests/System/Security/Cryptography/MLKemTestData.cs	Adds test data including certificate PEM strings for ML-KEM certificates.

Files not reviewed (1)

• src/libraries/System.Security.Cryptography/tests/System.Security.Cryptography.Tests.csproj: Language not supported

[bartonjs]

One question about a test, otherwise LGTM