Integrate parameter validation for Azure Key Vault client auth

[AsmCord]

New options allows more control which computer can sign and use the codesigning certificate, because it does not depend on the knowledge of the secret in the build pipeline

Integrate the ability to use a dedicated certificate to secure and validate the communication between the caller of the AzureSignTool (typically a build machine) and the Key Vault which might be located elsewhere.

Add new parameter options to control the behavior.

[vcsjones]

Does this compile without warning? I would expect the nullability analyzer to be complaining about returning null from a non-null returning method.

Suggested change

	private X509Certificate2 LoadCertificateByThumbprint(string thumbprint, System.Security.Cryptography.X509Certificates.StoreLocation storeLocation)
	private X509Certificate2? LoadCertificateByThumbprint(string thumbprint, System.Security.Cryptography.X509Certificates.StoreLocation storeLocation)

[AsmCord]

I missed the #nullable enable pragma in the file. I adapted the null handling

[vcsjones]

Would it make sense to try the LocalMachine store if it couldn't find one in CurrentUser?

Suggested change

	X509Certificate2 clientCertificate = LoadCertificateByThumbprint(certificateThumbPrint, StoreLocation.CurrentUser);
	X509Certificate2? clientCertificate = LoadCertificateByThumbprint(certificateThumbPrint, StoreLocation.CurrentUser);
	clientCertificate ??= LoadCertificateByThumbprint(certificateThumbPrint, StoreLocation.LocalMachine);

[AsmCord]

I updated the code accordingly

[AsmCord]

I updated the pull request

[vcsjones]

It would be nice if we did some validation on the thumbprint here to catch typos. Something like:

static bool IsValidHex(string input)
{
    if (input is not { Length: 40 })
    {
        return false;
    }
    
    foreach (char c in input)
    {
        switch (c)
        {
            case >= 'a' and <= 'f':
            case >= 'A' and <= 'F':
            case >= '0' and <= '9':
                continue;
            default:
                return false;
        }
    }
    
    return true;
}

If it returns false then we should write an error to the context.