Align CoseKey async verification with synchronous validation

[Copilot]

CoseKey async verification accepted signatures with missing or mismatched protected alg headers, unlike synchronous verification.

• Validation

  • Validate the protected algorithm before async verification.
  • Apply consistent validation to CoseSign1Message and CoseSignature.

• Coverage

  • Cover missing and mismatched algorithm headers.
  • Assert matching sync and async behavior.

[azure-pipelines]

Azure Pipelines:
15 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @bartonjs, @vcsjones, @dotnet/area-system-security
See info in area-owners.md if you want to be subscribed.

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).
12 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

This PR makes COSE signature verification stricter and consistent by ensuring async verification performs the same protected alg header validation as the sync paths when verifying with a CoseKey.

Changes:

• Add protected alg validation to VerifyDetachedAsync(CoseKey, Stream, …) for both CoseSign1Message and CoseSignature.
• Refactor CoseSign1Message sync verification to reuse a shared ValidateAlgorithm helper.
• Add regression tests covering missing and mismatched protected alg headers and asserting sync/async parity.

Show a summary per file

File	Description
src/libraries/System.Security.Cryptography.Cose/tests/CoseSign1MessageTests.Verify.Stream.cs	Adds regression coverage for missing/mismatched protected alg headers and asserts sync/async both throw.
src/libraries/System.Security.Cryptography.Cose/tests/CoseMultiSignMessageTests.Verify.Stream.cs	Adds parallel regression coverage for CoseSignature verification in CoseMultiSignMessage.
src/libraries/System.Security.Cryptography.Cose/src/System/Security/Cryptography/Cose/CoseSignature.cs	Adds ValidateAlgorithm(key) before async verification and inside the sync verification core to enforce protected alg matching.
src/libraries/System.Security.Cryptography.Cose/src/System/Security/Cryptography/Cose/CoseSign1Message.cs	Replaces inline sync validation with ValidateAlgorithm(key) and adds the same validation to the async verification entrypoint.

Copilot's findings

• Files reviewed: 4/4 changed files
• Comments generated: 2

[Copilot]

Copilot's findings

• Files reviewed: 5/5 changed files
• Comments generated: 1

[Copilot]

Copilot's findings

• Files reviewed: 5/5 changed files
• Comments generated: 0 new