GDS Client: create a new .pfx (fresh key pair) from a .der certificate

[romanett]

Proposed changes

The GDS Client could load a public-only certificate (e.g. from a .der file), but there was no clear end-to-end way to turn it into a usable .pfx that carries a private key. Temporary certificates were only created as a side effect of some CSR paths.

This adds a "New Key Pair (.pfx)" action to ApplicationCertificateControl that clones the identity of the currently loaded certificate and generates a fresh key pair for it:

• Reuses the original certificate's subject name and its Subject Alternative Name (application URI(s) and domain names).
• Generates a brand new RSA key pair, matching the original key size when available (falling back to the library default).
• Exports the result as a .pfx via a save dialog, encrypted with the password from the existing Private Key Password box when one is provided.
• Loads the new certificate back into the control and refreshes the displayed value.

The button is wired into the existing buttons panel in the designer alongside Request New / Apply Changes.

Related Issues

• Fixes GDS Client: Create a new .pfx from information in a .der (clone cert, create new private/public keypair) #742

Types of changes

• Bugfix (non-breaking change which fixes an issue)
• Enhancement (non-breaking change which adds functionality)
• Test enhancement (non-breaking change to increase test coverage)
• Breaking change (fix or feature that would cause existing functionality to not work as expected, requires version increase of Nuget packages)
• Documentation Update (if none of the other choices apply)

Checklist

• I have read the CONTRIBUTING doc.
• I have signed the CLA.
• I ran tests locally with my changes, all passed.
• I fixed all failing tests in the CI pipelines.
• I fixed all introduced issues with CodeQL and LGTM.
• I have added tests that prove my fix is effective or that my feature works and increased code coverage.
• I have added necessary documentation (if appropriate).
• Any dependent changes have been merged and published in downstream modules.

Further comments

This is a WinForms sample UI change; the project builds cleanly (0 errors) but the button flow itself was not runtime-verified, so a quick manual smoke test in the GDS Client is worthwhile. The new certificate reuses the SAN from the source certificate rather than re-deriving domains from application configuration, keeping the clone faithful to the loaded .der.