Add regression test for expired self-signed trusted chain (#48794)

[virzak]

Regression test for #48794.

Background

The issue reported that on Linux, building a chain for an expired, trusted self-issued (self-signed) certificate with

ChainPolicy.VerificationFlags = X509VerificationFlags.IgnoreNotTimeValid;
ChainPolicy.RevocationMode = X509RevocationMode.Online;
ChainPolicy.RevocationFlag = X509RevocationFlag.ExcludeRoot;
ChainPolicy.VerificationTime = DateTime.Now;

returned Build() == false with NotTimeValid,RevocationStatusUnknown,UntrustedRoot, while Windows returned true. The report was filed against .NET 5 / OpenSSL 1.1.

Findings

The scenario no longer reproduces on current main. Verified end-to-end against a locally built runtime, including the faithful variant that installs the certificate into the user Root trust store (mirroring update-ca-certificates): the chain now builds successfully with NotTimeValid as the only (ignored) status, matching Windows and macOS.

Confirmed this holds across both supported OpenSSL lines — a native reproduction of the verify path returns X509_V_ERR_CERT_HAS_EXPIRED (not an untrusted-root code) for an expired self-signed trust anchor on both OpenSSL 1.1.1 and 3.0. The behavior was closed by intervening chain-handling changes since .NET 5 (notably #66968, "Fix revocation processing on expired chains").

Change

Adds DynamicChainTests.BuildChainForExpiredSelfSignedCertificate, a [Theory] over NoCheck and Online (ExcludeRoot) revocation, asserting that an expired trusted self-signed certificate builds successfully, does not report UntrustedRoot/PartialChain, and surfaces only the ignored NotTimeValid. This locks in the correct cross-platform behavior. Test-only; no product code changes.

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).
13 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @bartonjs, @vcsjones, @dotnet/area-system-security
See info in area-owners.md if you want to be subscribed.

[bartonjs]

Two minor things, otherwise looks good. Thanks :)

[bartonjs]

I don't think the comment adds anything.

Suggested change

	// Regression test for https://github.com/dotnet/runtime/issues/48794
	//
	// An expired self-issued (self-signed) certificate that is trusted must build
	// successfully when NotTimeValid is ignored, with the certificate's expiration
	// being the only reported error. Historically on Linux this scenario additionally
	// reported UntrustedRoot (the expired trust anchor was not recognized as trusted)
	// and RevocationStatusUnknown (revocation processing was skipped for the
	// "not time valid" chain), causing Build to return false while it returned true on
	// Windows and macOS.

[bartonjs]

If the theory isn't varying the revocation flag, let's remove the parameter and simplify the theory

[virzak]

Thanks for the review! Both addressed in the latest push: dropped the comment block and removed the unused revocationFlag parameter (it was always ExcludeRoot, the default), so the theory now varies only RevocationMode.