Use TLS channel binding in Negotiate authentication

[DeagleGross]

• pass Kestrel's TLS endpoint channel binding token to managed NegotiateAuthentication contexts
• keep the owned channel binding alive for connection-scoped multi-round NTLM/Kerberos exchanges
• preserve existing behavior for non-HTTPS requests, unavailable channel bindings, and IIS/HTTP.sys server-integrated authentication deferral
• add focused tests for token forwarding, fallback behavior, multi-round state reuse, and channel binding ownership

Resolves #68315

[Copilot]

Pull request overview

This PR enhances the Negotiate authentication handler to forward the TLS endpoint channel binding token (CBT) into managed NegotiateAuthentication so that NTLM/Kerberos over HTTPS can be cryptographically bound to the underlying TLS channel, and ensures the CBT’s lifetime is preserved across multi-round handshakes.

Changes:

• Pass ITlsConnectionFeature endpoint CBT bytes into the connection-scoped Negotiate state at creation time.
• Introduce an owned ChannelBinding implementation (NegotiateChannelBinding) and ensure it is disposed with the Negotiate state.
• Add/extend tests to validate CBT forwarding, fallback behavior when CBT is unavailable, and reuse across multi-round exchanges.

Show a summary per file

File	Description
src/Security/Authentication/Negotiate/src/NegotiateHandler.cs	Reads TLS endpoint CBT (when available) and passes it into state creation.
src/Security/Authentication/Negotiate/src/Internal/INegotiateStateFactory.cs	Extends the factory contract to accept a CBT payload.
src/Security/Authentication/Negotiate/src/Internal/NegotiateStateFactory.cs	Forwards CBT into NegotiateState.
src/Security/Authentication/Negotiate/src/Internal/NegotiateState.cs	Creates NegotiateAuthentication with a ChannelBinding and owns/disposes it.
src/Security/Authentication/Negotiate/src/Internal/NegotiateChannelBinding.cs	New owned ChannelBinding implementation that copies CBT bytes into unmanaged memory.
src/Security/Authentication/Negotiate/test/Negotiate.Test/NegotiateHandlerTests.cs	Adds tests for CBT behavior and extends the test connection to expose TLS feature behavior.
src/Security/Authentication/Negotiate/test/Negotiate.Test/NegotiateChannelBindingTests.cs	New unit test verifying CBT bytes are copied/owned by NegotiateChannelBinding.
src/Security/Authentication/Negotiate/test/Negotiate.Test/EventTests.cs	Updates the test factory implementation for the new CBT-aware signature.

Review details

Tip

Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 8/8 changed files
• Comments generated: 1
• Review effort level: Lite

[Youssef1313]

Only reviewed the last commit. Previous commits previously approved by @BrennanConroy.