Implement CertificateSubjectName authentication

[Seáic Mac Murchadha (seaic-mac-murchadha)]

Summary

Following up on #576.

This implements CertificateSubjectName authentication in the same way as the .NET implementation, by resolving a certificate from the Windows certificate store using the configured subject name.

Implementation

• Add CertificateSubjectName configuration support, including certificate store name and valid-certificate filtering
• Resolve certificates by subject name from the Windows certificate store
• Support RSA private keys backed by CNG and legacy CSP providers
• Generate MSAL client assertions using PS256, with RS256 fallback where required
• Support SHA-256/SHA-1 certificate thumbprints and optional x5c
• Integrate the generated assertion with MsalAuth using MSAL's client_assertion flow

Testing

Full test suite passed: 3927 passed, 438 skipped.

Resolves #348.