…uer store (1.5.x) (#3898)

# Description

Fixes #3896 on the `1.5.x` maintenance line. A server configured with
`SecurityConfiguration.SendCertificateChain = true`, whose application
instance certificate is issued by a CA placed in the **issuer store**
(`TrustedIssuerCertificates`), sent only the **leaf** certificate
instead of the full chain. Clients that rely on receiving the chain then
failed to connect.

## Root cause

Introduced in `1.5.375` by commit `f001eabcc` ("Add support for ECC
profiles", #2398), which moved chain loading into
`CertificateTypesProvider.LoadCertificateChainAsync`:

```csharp
if (await m_certificateValidator.GetIssuersAsync(certificate, issuers).ConfigureAwait(false))
{
    for (int i = 0; i < issuers.Count; i++)
    {
        certificateChain.Add(issuers[i].Certificate);
    }
}
```

`GetIssuersAsync` returns `isTrusted` — `true` only when the issuer is
found in the **trusted** store — but populates the `issuers` out-list
regardless (trusted → issuer → untrusted). When the CA lives in the
**issuer store** (the spec-recommended setup), the call returns `false`,
so the already-resolved issuers were discarded and the chain stayed
leaf-only.

This is a regression from `1.5.374`, where the issuers were appended
**unconditionally**.

## Fix

Append the resolved issuers unconditionally; the boolean trust result is
intentionally ignored — a server must send its chain even when the
issuing CA is in the issuer store rather than the trusted store.

```csharp
_ = await m_certificateValidator.GetIssuersAsync(certificate, issuers).ConfigureAwait(false);
for (int i = 0; i < issuers.Count; i++)
{
    certificateChain.Add(issuers[i].Certificate);
}
```

The companion fix for the 2.0 line (`master`) is in a separate PR.

## Tests

New `CertificateTypesProviderTests`:

- `LoadCertificateChainResolvesIssuerFromIssuerStoreAsync`: the CA is
placed in the issuer store only — **not** the trusted store — and the
resolved chain is asserted to be `leaf + CA` (and the raw blob `leaf ||
CA` byte-for-byte). Confirmed this test **fails** with the original gate
and **passes** with the fix.
- `LoadCertificateChainFallsBackToLeafWhenIssuerMissingAsync`: when the
CA is in neither store, the chain is leaf-only without throwing.

Verified locally on **net48** and **net10.0** (new tests + existing
`VerifyIssuerChain*` validator tests pass). Build is clean.

## Related Issues

Fixes #3896.

## Checklist

- [ ] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [x] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [x] I have added all necessary documentation (no public API change;
behavioural fix only).
- [x] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [ ] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed. (Ran the
certificate suites on net48 + net10.0; full-solution run pending CI.)
- [ ] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [ ] I have addressed **all** PR feedback received.

Co-authored-by: agent <agent@local>