[release/8.0-staging] Backport Replace test certificate chain that uses RSA+SHA-1

[vcsjones]

Backport of #121450 to release/8.0-staging

cc @bartonjs

Customer Impact

These are test only changes. These changes react to more environments in CI rejecting certificate chains that use an RSA+SHA-1 root certificate.

• Customer reported
• Found internally

Regression

• Yes
• No

Testing

Tests that were failing are now passing in CI.

Risk

None, test only changes.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull Request Overview

This PR backports a change to replace test certificate chain data that uses RSA+SHA-1 with a newer RSA+SHA-256 certificate chain for the microsoft.com SSL certificate used in cryptography tests.

• Updates certificate test data from an older certificate chain (microsoft.com → Microsoft RSA TLS CA 01 → Baltimore CyberTrust Root) to a newer chain (microsoft.com → Microsoft Azure RSA TLS Issuing CA 08 → DigiCert Global Root G2)
• Updates all verification times from 2021 dates to 2025 dates to match the new certificate's validity period (2025-10-01 to 2026-03-30)
• Adjusts test expectations for hostname matching, chain element counts, and authority key identifiers to reflect the new certificate chain structure

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/libraries/System.Security.Cryptography/tests/X509Certificates/TestData.cs	Replaces the hex-encoded certificate data for MicrosoftDotComSslCertBytes, MicrosoftDotComIssuerBytes, and MicrosoftDotComRootBytes with new certificates using SHA-256 instead of SHA-1
src/libraries/System.Security.Cryptography/tests/X509Certificates/ChainTests.cs	Updates verification times to 2025 dates, adjusts platform-specific expectations for chain element counts, removes SHA-1 signature support checks, and improves error messages for better debugging
src/libraries/System.Security.Cryptography/tests/X509Certificates/CollectionTests.cs	Updates verification times in collection-related tests to match the new certificate validity period
src/libraries/System.Security.Cryptography/tests/X509Certificates/MatchesHostnameTests.cs	Updates hostname test cases to match the Subject Alternative Names in the new certificate (e.g., replacing www.microsoft.com with www.microsoft.com.au, adding copilot.ai domains)
src/libraries/System.Security.Cryptography/tests/X509Certificates/ExtensionsTests/AuthorityKeyIdentifierTests.cs	Updates expected hex values for authority key identifier tests to match the new certificate issuer (DigiCert Global Root G2 instead of Baltimore CyberTrust Root)

[bartonjs]

Test-only changes, auto-approved (for servicing)