Delete CNG private keys when CleanupCredentials removes expired certs

[darkfronza]

CleanupCredentials previously deleted the certificate from the Windows store but left the paired CNG private key in the provider, accumulating orphan .PCPKSP blobs on disk as certificates were renewed.

• Add a delete-key URI flag on CAPIKMS.DeleteCertificate. When set, the cert's CNG key is removed via nCryptDeleteKey before the cert context is deleted, so a partial failure leaves the cert in place for retry rather than orphaning the key.
• Rewrite CAPIKMS.CleanupCredentials to walk the store directly and delete each expired cert together with its CNG key. Enumeration is restarted after every delete because CertDeleteCertificateFromStore frees the context the next find call would chain from.
• TPMKMS.deleteCertificateFromWindowsCertificateStore now sets delete-key=true on its URI, since TPMKMS-managed certs have a 1:1 CNG key with no independent use.
• Update TestKMS_CleanupCredentials_capi to assert that both the certificate and the CNG private key are removed.

EFF-232

Change-Type: feature
Release-Note: yes
Audience: developer
Impact: low
Breaking: false

[maraino]

Capi already supports the DeleteKey method, why don't use just that in TPMKMS?

[darkfronza]

@maraino I think that the interface for the method is less clear in that internal context for deleting the certificate and associated key, so using cryptFindCertificatePrivateKey + nCryptDeleteKey sounds easier then building a *apiv1.DeleteKeyRequest out of the available data.