Add private key password support to GDS Client certificate flows

[romanett]

Proposed changes

The GDS Client had a m_certificatePassword field that was threaded through the request, signing, and PFX code paths but was only ever initialized to null. There was no UI element to enter a private key password, so every flow resolved to an empty/null password and password-protected keys could not be used.

This change adds a masked password input to ApplicationCertificateControl and wires it into all relevant flows:

• A Private Key Password text box (UseSystemPasswordChar) in the registration buttons panel, synced into m_certificatePassword on change and reset on initialization.
• The password now feeds new key-pair requests, CSR signing (PFX/PEM private-key read), and PFX read/write on certificate merge.
• LoadPrivateKeyAsync was a no-op stub that ignored its password argument. It now opens the certificate store and loads the private key using the supplied password (falling back to the public-only certificate when the store does not support key loading or no match is found).
• Fixed a latent bug where the GDS-returned PFX (pull mode) was loaded with string.Empty instead of the request password, which would fail to decrypt a password-protected PFX.

Verified with a local build of GlobalDiscoveryClient.csproj (0 warnings, 0 errors).

Related Issues

• Fixes GDS Client: Private key password support for all use cases #743

Types of changes

What types of changes does your code introduce?
Put an x in the boxes that apply. You can also fill these out after creating the PR.

• Bugfix (non-breaking change which fixes an issue)
• Enhancement (non-breaking change which adds functionality)
• Test enhancement (non-breaking change to increase test coverage)
• Breaking change (fix or feature that would cause existing functionality to not work as expected, requires version increase of Nuget packages)
• Documentation Update (if none of the other choices apply)

Checklist

Put an x in the boxes that apply. You can also fill these out after creating the PR. If you're unsure about any of them, don't hesitate to ask. We're here to help! This is simply a reminder of what we are going to look for before merging your code.

• I have read the CONTRIBUTING doc.
• I have signed the CLA.
• I ran tests locally with my changes, all passed.
• I fixed all failing tests in the CI pipelines.
• I fixed all introduced issues with CodeQL and LGTM.
• I have added tests that prove my fix is effective or that my feature works and increased code coverage.
• I have added necessary documentation (if appropriate).
• Any dependent changes have been merged and published in downstream modules.

Further comments

This is a WinForms sample control, so the change is UI-driven and not covered by automated tests. The password is read directly from the text box into the existing field, keeping the surrounding request/signing/PFX code paths unchanged aside from now receiving a real password. LoadPrivateKeyAsync intentionally degrades gracefully to the public certificate rather than throwing, to preserve existing behavior when a store does not support private-key export.