Cache MAA (Microsoft Azure Attestation) JWT tokens in-process to
avoid redundant native DLL calls and network round-trips to the MAA
endpoint on every mTLS cert mint.

Changes:
- PopKeyAttestor: add ConcurrentDictionary<string, AttestationToken>
  keyed by '{maaEndpoint}|{clientId}'. MAA cache is checked before any
  native or network call. On MAA cache hit the key handle is not
  required. MAA tokens within 5 min of expiry (matching MSAL's
  AccessTokenExpirationBuffer) are considered stale and trigger a fresh
  MAA attestation call. Key validation is deferred to cache-miss path.
  Add ResetCacheForTest() and overridable s_expirationBuffer for tests.
- ImdsV2Tests: call ResetCacheForTest() in TestCleanup. Add three tests:
  - MaaTokenCache_Hit_DoesNotCallAttestationProviderAgain
  - MaaTokenCache_ExpiredToken_CallsAttestationProviderAgain
  - MaaTokenCache_DifferentEndpoints_CachedSeparately

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- Add per-key SemaphoreSlim (s_keyLocks) to prevent concurrent in-flight
  attestation calls for the same cache key (thundering herd protection)
- Double-check cache after acquiring lock so waiters skip the network call
- Evict stale entries in TryGetCachedToken via TryRemove to prevent
  unbounded memory growth
- Replace null with string.Empty in cache-hit AttestationResult message
  for consistency and null-safety
- ResetCacheForTest() now also clears s_keyLocks
- Add MaaTokenCache_ConcurrentCacheMiss_SingleFlightCallsProviderOnce test

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…he key comment, new test

- Move keyHandle validation before cache check (Bogdan)
- Remove redundant ThrowIfCancellationRequested (Bogdan)
- Add ILoggerAdapter param; log cache hit/miss/store (Bogdan + gladjohn)
- Register PopKeyAttestor.ResetCacheForTest with ApplicationBase.ResetStateForTest via callback (gladjohn)
- Add cache key design comment explaining why Key.ID is not included (Bogdan + gladjohn)
- Update AttestationTokenProvider delegate type to thread logger from request context
- Update MaaTokenCache_DifferentEndpoints test: always pass valid handles (no null on cache hit)
- Add MaaTokenCache_CertCacheMiss_MaaTokenCacheStillFresh test (gladjohn)
- Update XML doc comment on PopKeyAttestor class (gladjohn)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…erflow, test fixes

- Add ArgumentNullException guard to ApplicationBase.RegisterResetCallback
- Replace hand-rolled ConcurrentDictionary<string,SemaphoreSlim> with KeyedSemaphorePool
- Fix TryGetCachedToken: flip comparison to avoid DateTimeOffset.MinValue - buffer overflow
- MaaTokenCache_Hit: add WithForceRefresh + mocks so second acquire exercises cert/MAA path
- MaaTokenCache_Concurrent: release gate for all tasks.Length so regression fails fast instead of hanging
- MaaTokenCache_CertCacheMiss: add TokenSource.IdentityProvider assertion to prove path was exercised

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…l is stateless)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Cache key changes from '{endpoint}|{clientId}|{keyId}'
to '{endpoint}|{keyId}'.

MAA attests the CNG key itself; clientId is forwarded to the attestation
service as metadata but does not change which token is valid for a given
key. Different managed identities (SAMI vs UAMI) sharing the same CNG key
at the same endpoint should share the cached token.

Updated the cache key design comment to explain:
- why clientId is intentionally excluded
- why a single static field (gladjohn's suggestion) is insufficient once
  keyId is in play (multiple endpoint|keyId combinations possible)

keyId and endpoint remain in the key per bgavrilMS and gladjohn feedback.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…emaphore comment, test keyId fixes

- Switch Info(string) to Info(Func<string>) in PopKeyAttestor to avoid eager string allocation
- Add NormalizeEndpoint() helper that trims trailing slash before composing cache key
- Add comment explaining KeyedSemaphorePool stays bounded (named keys only; ephemeral share one slot)
- Fix MaaTokenCache_DifferentEndpoints_CachedSeparately: use const string keyIds (rsa.Key.KeyName is null for ephemeral keys)
- Fix MaaTokenCache_ConcurrentCacheMiss_SingleFlightCallsProviderOnce: add explicit keyId argument

82/82 ImdsV2Tests pass on .NET 8.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>