Fix SendAsync from impersonated context with default credentials

[wfurt]

As @geoffkizer suggested, this fails because the connection setting is updated only in constructor. Even if options are passed to HttpHandler constructor, we actually create HttpConnectionSettings first and then we updated it.
I was originally thinking about updating relevant setters in HttpHandler but I end up updating the CloneAndNormalize and that seems sufficient. That has benefit that all the logic is still encapsulated in HttpConnectionSettings.
This is pretty trivial two line change.

Now, the trouble is testing. Some existing NTLM tests use HttpListener and that is problematic because of lack of fine control and general reliance. And we do not have any impersonation tests for HTTP.

To solve the first issue, I used NTLM code from Common and I added (duplicate?) NTLM/Negotiate test using standard Loopback pattern. If that proves to be stable and working we can possibly remove reliance HttpListener and clean up rest of the tests. (and get some more coverage for code Kestrel use via reflection (or make that finally public)).

To solve the second problem, I moved existing WindowsIdentityFixture to TestUtilities. That essentially creates ad hoc account and use that for testing. That seems to require some level of privilege. The existing tests in System.Security did not have any guard and they seems to run fine in CI. We can possibly update CanRunImpersonatedTests if this becomes nuisance. Certainly running tests from elevated shell seems to work fine but I don't know if that is really needed.

With that, I added new test to verify that HttpClient will open new connection for the impersonated context.
And it also verifies that the authenticated identity is different.

Fixes #58033

[ghost]

Tagging subscribers to this area: @dotnet/ncl
See info in area-owners.md if you want to be subscribed.

Issue Details

---

As @geoffkizer suggested, this brown because the connection setting is updated only in constructor. Even if options are passed to HttpHandler constructor, we actually create HttpConnectionSettings first and then we updated it.
I was originally thinking about updating relevant setters in HttpHandler but I end up updating the CloneAndNormalize and that seems sufficient. That has benefit that all the logic is still encapsulated in HttpConnectionSettings.
This is pretty trivial two lone change.

Now, the trouble is testing. Some existing NTLM tests use HttpListener and that is problematic because of lack of fine control and general reliance. And we do not have any inpersonification tests for HTTP.

To solve the first issue I used NTLM code from Common and I added (duplicate?) NTLM/Negotiate test using standard Loopback pattern. If that proves to be stable and working we can possibly remove reliance HttpListener and clean up rest of the tests. (and get some more coverage for code Kestrel use via reflection (or make that finally public))

To solve the second problem I moved existing WindowsIdentityFixture to TestUtilities. That essentially creates ad hoc account and use that for testing. That seems to require some level of privilege. The existing tests in System.Security did not have any guard and they seems to run fine in CI. We can possibly update CanRunInpersonificatedTests if this becomes nuisance. Certainly running tests from elevated shell seems to work fine but I don't know if that is really needed.

With that, I added new test to verify that HttpClient will open new connection for the inpersonioficated context.
And it also verifies that the authenticated identity is different.

fixes #58033

Author:	wfurt
Assignees:	wfurt
Labels:	area-System.Net.Http
Milestone:	-

[wfurt]

/azp run runtime-libraries-coreclr outerloop

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[geoffkizer]

A couple small issues above, generally looks good.

[wfurt]

Test failures seems unrelated. I did not see any failure related to authentication.

[wfurt]

/azp run runtime-libraries-coreclr outerloop

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[geoffkizer]

Please find and replace Impersonificated => Impersonated

Other than that, LGTM

[wfurt]

test failures looks unrelated. Mostly infrastructure & #58927.

[danmoseley]

Does this need 6.0 port..

[danmoseley]

/backport to release/6.0

[github-actions]

Started backporting to release/6.0: https://github.com/dotnet/runtime/actions/runs/1237858774