Clarify certificate validation cache behavior and requirements

[cincuranet]

Fixes #37435

---

Internal previews

File	Preview link
aspnetcore/security/authentication/certauth.md	aspnetcore/security/authentication/certauth

[guardrex]

Thanks @cincuranet! ... The article probably doesn't cross-link the API in other spots, but let's get the ball rolling by adding the links to this paragraph. Most of the security articles are receiving overhauls, and we'll add links elsewhere later. Also, let's assume one subject for the last sentence ("you") by striking the comma.

[guardrex]

Suggested change

When `AddCertificateCache` is enabled, the result produced by `OnCertificateValidated` must be a pure function of the authentication scheme and certificate. Don't base the result on request context because the cached result is reused for subsequent requests. Place request-context-dependent decisions in an authorization policy, or provide a context-aware implementation of `ICertificateValidationCache`.

When <xref:Microsoft.Extensions.DependencyInjection.CertificateAuthenticationAppBuilderExtensions.AddCertificateCache%2A> is enabled, the result produced by <xref:Microsoft.AspNetCore.Authentication.Certificate.CertificateAuthenticationEvents.OnCertificateValidated%2A> must be a pure function of the authentication scheme and certificate. Don't base the result on request context because the cached result is reused for subsequent requests. Place request-context-dependent decisions in an authorization policy or provide a context-aware implementation of <xref:Microsoft.AspNetCore.Authentication.Certificate.ICertificateValidationCache>.

[javiercn]

@guardrex can you fix it and get it merged?

[guardrex]

@javiercn (cc: @danroth27) ... Several new rules have been instituted by the docs division, and I may have lost some repo authority. I no longer have that power. I can't edit PRs directly any longer (I must open a PR against the sender's branch), nor can I accept/approve my own suggestions ☝️. I can't merge my PRs any longer without someone else's approval, even if Copilot generated the PR and made all of the commits ... and even if I'm only fixing a spelling error. I can't approve and leave suggestions for someone else's PR ... they now have to ping me again for another review after they accept my suggestions. These new rules have slowed things down.

@cincuranet ... You'll need to commit my suggestion, and then I can approve the PR. Alternatively, I think @wadepickett or @tdykstra can approve the suggestions because I think they're repo owners with more powers than I have.