[PM-19601] Introduce options for adding certificates to trust without root

[justindbaur]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-19601
https://bitwarden.atlassian.net/browse/PM-19599

📔 Objective

All for customizing trusted root certificates without the need of update-ca-certificates. This helps in us not needing root in containers. This sets up the usage of the custom server certificate validation callback for SMTP and all HttpClients when created with IHttpClientFactory. I am not calling AddX509ChainCustomization in any project yet so this feature doesn't light up yet. But the expectation is that it would be added to all self hosted containers.

This code is to replace this bash in the container start.

The default of the setting maps directly to the location we used to copy certificates from so for the most part 0 customization should have to be done by anyone to get this feature if there were previously placing certificates in that directory. The setting is largely exposed for developers to map it to a custom directory.

📸 Screenshots

⏰ Reminders before review

• Contributor guidelines followed
• All formatters and local linters executed and passed
• Written new unit and / or integration tests where applicable
• Protected functional changes with optionality (feature flags)
• Used internationalization (i18n) for all UI strings
• CI builds passed
• Communicated to DevOps any deployment requirements
• Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

• 👍 (:+1:) or similar for great changes
• 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
• ❓ (:question:) for questions
• 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
• 🎨 (:art:) for suggestions / improvements
• ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
• 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
• ⛏ (:pick:) for minor or nitpick changes

[github-actions]

Checkmarx One – Scan Summary & Details – 3fca8e7b-a323-4769-93ac-cce3a7271e04

Great job, no security vulnerabilities found in this Pull Request

[codecov]

Codecov Report

Attention: Patch coverage is 94.64286% with 6 lines in your changes missing coverage. Please review.

Project coverage is 45.20%. Comparing base (39ac933) to head (a94e704).
Report is 11 commits behind head on main.

Files with missing lines	Patch %	Lines
...hainCustomization/PostConfigureX509ChainOptions.cs	92.30%	2 Missing and 2 partials ⚠️
...latform/X509ChainCustomization/X509ChainOptions.cs	91.30%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5609      +/-   ##
==========================================
+ Coverage   45.12%   45.20%   +0.07%     
==========================================
  Files        1565     1568       +3     
  Lines       71719    71839     +120     
  Branches     6424     6435      +11     
==========================================
+ Hits        32363    32473     +110     
- Misses      37979    37987       +8     
- Partials     1377     1379       +2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[tangowithfoxtrot]

🚀