Fix certificate expiration during verification - #10510

Summary

Fixes #10509

A certificate could be valid when loaded into FSCertStore, later expire while the worker remained running, and still be used to successfully verify signed messages.

This PR enforces certificate expiration at verification time.

Root Cause

FSCertStore already checks has_expired() when certificates are loaded. However, Certificate.verify() only performed cryptographic signature verification and did not re-check the certificate's validity.

This created a time-of-use gap:

1. Certificate is valid when the worker starts.
2. Certificate is loaded and stored.
3. Certificate later expires.
4. Certificate.verify() is called for a new message.
5. Signature verification succeeds even though the certificate is expired.

Changes

• Added an expiration check at the beginning of Certificate.verify().
• Expired certificates now raise SecurityError before cryptographic signature verification.
• Kept the existing FSCertStore load-time expiration check unchanged.
• Added a regression test covering verification before and after certificate expiration.
• Updated the existing serialization test setup because its historical test certificates are expired and those tests are intended to exercise serialization behavior rather than certificate validity.

Testing

• All security tests pass: 37 passed, 1 skipped
• Flake8 passes for the modified files.
• The regression test verifies that:
  • a valid certificate can successfully verify a valid signature;
  • the same certificate is rejected once it is considered expired.

Scope

This change is intentionally limited to certificate expiration during verification. It does not change signature algorithms, certificate loading, certificate parsing, or unrelated exception handling.