Merging internal commits for release/9.0

[vseanreesermsft]

No description provided.

[dotnet-policy-service]

Tagging subscribers to this area: @bartonjs, @vcsjones, @dotnet/area-system-security
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

Updates COSE decoding/signing behavior and tests to handle indefinite-length CBOR containers and to surface clearer failures around the crit (Critical Headers) header.

Changes:

• Updated signing tests to run against both definite- and indefinite-length encodings for critical headers.
• Added decode tests for Sign1 and MultiSign covering missing/empty/invalid critical headers across attached/detached and definite/indefinite encodings.
• Adjusted COSE header map decoding to support indefinite-length maps and to wrap certain header validation failures as CryptographicException.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
src/libraries/System.Security.Cryptography.Cose/tests/CoseMessageTests.Sign.CustomHeaderMaps.cs	Expands critical-header signing tests to exercise both definite and indefinite CBOR encodings.
src/libraries/System.Security.Cryptography.Cose/tests/CoseMessageTests.DecodeSign1.cs	Adds Sign1 decoding tests for critical-header error cases across attached/detached and definite/indefinite inputs.
src/libraries/System.Security.Cryptography.Cose/tests/CoseMessageTests.DecodeMultiSign.cs	Adds MultiSign decoding tests for critical-header error cases across attached/detached and definite/indefinite inputs.
src/libraries/System.Security.Cryptography.Cose/src/System/Security/Cryptography/Cose/CoseMessage.cs	Allows decoding of indefinite-length header maps and improves error reporting for invalid header values; adds empty-crit validation.

Comments suppressed due to low confidence (1)

src/libraries/System.Security.Cryptography.Cose/tests/CoseMessageTests.DecodeSign1.cs:1

• The switch arm for (true, true) (detached + indefinite length) returns DetachedDefiniteHex, which duplicates the (true, false) case and prevents this test from actually exercising the detached/indefinite input. Update that arm to use DetachedIndefiniteHex.

// Licensed to the .NET Foundation under one or more agreements.