ML-KEM: Windows ephemeral implementation

[vcsjones]

This implements MLKem's ephemeral implementation (MLKemImplementation) on Windows using bcrypt CNG.

Contributes to #116304

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull Request Overview

This PR adds a Windows‐specific ephemeral implementation of ML-KEM via BCrypt CNG and updates tests to use a unified platform check.

• Introduces MLKemImplementation.Windows and corresponding interop layers for key generation, import/export, and encapsulation/decapsulation.
• Extends PqcBlobHelpers with ML-KEM parameter‐set support and updates the Common and BCL projects to include new CNG interop files.
• Changes X509 and PFX tests to use PlatformSupport.IsPqcMLKemX509Supported for gating, and adds a new resource string for invalid private keys.

Reviewed Changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/libraries/Common/src/System/Security/Cryptography/MLKemImplementation.Windows.cs	New Windows CNG–based ML-KEM implementation subclasses MLKem.
src/libraries/Common/src/System/Security/Cryptography/PqcBlobHelpers.MLKem.cs	Added ML-KEM blob‐magic mapping and parameter‐set helpers.
src/libraries/Common/src/Interop/Windows/BCrypt/Interop.BCryptDecapsulateEncapsulate.cs	Declared BCryptEncapsulate/BCryptDecapsulate P/Invoke wrappers.
src/libraries/Common/src/Interop/Windows/BCrypt/Interop.Blobs.cs	Added BCRYPT_MLKEM_KEY_BLOB struct and magic‐number constants.
src/libraries/Common/tests/System/Security/Cryptography/PlatformSupport.cs	Introduced IsPqcMLKemX509Supported to gate ML-KEM X509 tests.
src/libraries/System.Security.Cryptography/tests/X509Certificates/*	Switched ML-KEM test attributes to use PlatformSupport.
src/libraries/System.Security.Cryptography/src/System.Security.Cryptography.csproj	Included new interop and helper files for ML-KEM Windows support.
src/libraries/Microsoft.Bcl.Cryptography/src/Resources/Strings.resx	Added Cryptography_NotValidPrivateKey resource string.
src/libraries/Microsoft.Bcl.Cryptography/src/Microsoft.Bcl.Cryptography.csproj	Adjusted ItemGroup conditions to include Windows PQC support.

Comments suppressed due to low confidence (1)

src/libraries/Microsoft.Bcl.Cryptography/src/Resources/Strings.resx:159

• [nitpick] The new resource 'Cryptography_NotValidPrivateKey' isn't referenced anywhere. Either remove this dead entry or wire it up to the appropriate exception paths to avoid unused localization strings.

<data name="Cryptography_NotValidPrivateKey" xml:space="preserve">