Fix macOS CI: avoid empty-KeyUsage test cert

[marcschier]

Summary

Follow-up to #3948 (merged) that fixes a macOS-only CI failure introduced by the issuer/CA KeyUsage tests.

On the macOS Core test job, three tests failed with:

Interop+AppleCrypto+AppleCommonCryptoCryptographicException : Unknown format in import.
   at System.Security.Cryptography.X509Certificates.X509Pal.AppleX509Pal.GetCertContentType(...)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadCertificate(...)

The affected tests built a test CA with an empty KeyUsage extension (new X509KeyUsageExtension(X509KeyUsageFlags.None, true) → a zero-bit BIT STRING). Windows (CryptoAPI) and Linux (OpenSSL) load such a certificate, but macOS (AppleCrypto) rejects it as an unknown format. The production code is unaffected — this is purely a test-certificate artifact.

Changes

• Removed the degenerate empty-KeyUsage test certificate. The truly-absent KeyUsage case (built via CertificateRequest so no KeyUsage extension is emitted) already covers the GetKeyUsage() == None code path.
• The reject/suppress integration tests now use a present-but-insufficient DigitalSignature KeyUsage (a valid, macOS-loadable certificate that is still missing keyCertSign/cRLSign).

Testing

• CertificateValidator IssuerKeyUsage tests pass on Windows and Linux (net10.0). The change directly removes the macOS root cause (the empty-KeyUsage extension); all remaining test certificates use standard formats that macOS already loads (the compliant-CA test passed on macOS).

Relates to #3944 · follow-up to #3948

[Copilot]

Pull request overview

Note

Copilot couldn't run its full agentic review because no GitHub Actions runner was available. Make sure your repository has a runner available to run Copilot's review, or add a copilot-setup-steps.yml file specifying one with the runs-on attribute. See the docs for more details.

Fixes macOS CI failures in issuer/CA KeyUsage validation tests by avoiding generation of non-standard “empty KeyUsage” test certificates that AppleCrypto refuses to import.

Changes:

• Removes the test case that creates a CA certificate with a present-but-zero KeyUsage extension.
• Uses an omitted-KeyUsage CA certificate to cover the GetKeyUsage() == None path without the degenerate encoding.
• Updates reject/suppress integration tests to use a macOS-loadable but insufficient KeyUsage (DigitalSignature) for the issuer.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 60.18%. Comparing base (21eccdd) to head (1c4617e).

Additional details and impacted files

@@              Coverage Diff              @@
##           master378    #3953      +/-   ##
=============================================
+ Coverage      60.15%   60.18%   +0.02%     
=============================================
  Files            378      378              
  Lines          79082    79082              
  Branches       13840    13840              
=============================================
+ Hits           47574    47595      +21     
+ Misses         27088    27065      -23     
- Partials        4420     4422       +2     

see 11 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.