Add authenticated Artifact Signing profile root retrieval

[nurfed1]

Problem

Azure Artifact Signing certificate profiles can use a profile-specific root that
is not present in the normal public AuthRoot set. Consumers that need to verify
test or private-trust signatures should retrieve the root associated with the
selected profile instead of embedding a certificate that may later change.

Azure exposes an authenticated profile root-certificate operation, but psign's
portable Artifact Signing client currently only implements the signing
operation.

Change

Add an artifact-signing-root portable command and the corresponding operation
to psign-codesigning-rest.

The command:

• uses the existing Artifact Signing authentication modes;
• retrieves the root currently associated with the specified account and
  certificate profile;
• uses the profile-root operation's separate preview API version;
• validates the response as a DER-encoded X.509 CA certificate before writing
  it;
• writes the certificate to an explicitly selected output path.

Example:

psign-tool artifact-signing-root \
  --endpoint https://wus.artifactsigning.azure.net \
  --account-name myAccount \
  --profile-name myProfile \
  --output ./artifact-signing-root.cer \
  --managed-identity

Endpoint and response safety

The implementation:

• requires an HTTPS Azure Artifact Signing data-plane origin;
• accepts only hosts below codesigning.azure.net or
  artifactsigning.azure.net;
• rejects user information, paths, queries, fragments, and non-default ports;
• validates the endpoint before acquiring credentials;
• disables redirects;
• percent-encodes account and profile path segments;
• limits successful certificate responses to 1 MiB;
• limits error responses to 64 KiB;
• rejects empty, unexpected-content-type, malformed DER, and non-CA responses.

Validation

Added focused tests covering:

• URL construction and path-segment escaping;
• accepted and rejected endpoint forms;
• endpoint validation before credential acquisition;
• authenticated certificate retrieval;
• supported certificate content types;
• malformed, empty, and non-CA certificate responses;
• bounded response handling;
• HTTP error reporting.

The full fork CI matrix passes, including Unix portable checks,
artifact-signing-rest feature tests, clippy, formatting, .NET tool packaging,
and PowerShell module tests.

The command was also exercised against a live Azure Artifact Signing test
profile using federated credentials. The returned root was used to verify a PE
signed by that profile successfully.