Fix #738: Support user certificate authentication in UA Sample Client

[romanett]

Proposed changes

When connecting to a server whose endpoint offers an X509 (certificate) user identity token, the UA Sample Client could not authenticate with a user certificate. Selecting Certificate showed a <Browse...> entry, but nothing happened: no picker opened and the session was opened with a null identity (effectively anonymous), so certificate authentication never occurred.

This wires up the missing behavior in SessionOpenDlg:

• The <Browse...> entry now opens a certificate picker (X509Certificate2UI.SelectFromCollection over CurrentUser\My, filtered to certificates that have a private key). The chosen certificate's subject is shown and selected in the combo box.
• OkBTN_Click gained a Certificate branch that builds a real UserIdentity from an X509IdentityToken (using the selected certificate's raw data) and passes it to session.OpenAsync(...). It also guards against confirming without a selected certificate.
• Housekeeping: the cached certificate is reset when the identity type changes and disposed with the dialog.

The approach mirrors the existing certificate-impersonation flow in the UserAuthentication workshop client, keeping the sample consistent.

Related Issues

• Fixes UA Sample Client: user certificate authentication not supported — no certificate 'Browse' dialog #738

Types of changes

• Bugfix (non-breaking change which fixes an issue)
• Enhancement (non-breaking change which adds functionality)
• Test enhancement (non-breaking change to increase test coverage)
• Breaking change (fix or feature that would cause existing functionality to not work as expected, requires version increase of Nuget packages)
• Documentation Update (if none of the other choices apply)

Checklist

• I have read the CONTRIBUTING doc.
• I have signed the CLA.
• I ran tests locally with my changes, all passed.
• I fixed all failing tests in the CI pipelines.
• I fixed all introduced issues with CodeQL and LGTM.
• I have added tests that prove my fix is effective or that my feature works and increased code coverage.
• I have added necessary documentation (if appropriate).
• Any dependent changes have been merged and published in downstream modules.

Further comments

This is a WinForms sample dialog, so the fix is validated by a clean Release build (0 errors, no new warnings on the changed file) rather than automated tests. The picker is scoped to the CurrentUser\My store and only offers certificates with an available private key, since a private key is required for X509 user authentication.