crypto: support --use-system-ca on Windows

[joyeecheung]

This patch adds support for --use-system-ca on Windows, the
certificates are collected following Chromium's policy,
though the following are left as TODO and out of this patch.

• Support for user-added intermediate certificates
• Support for distrusted certificates

Since those aren't typically supported by other runtimes/tools
either, and what's implemented in this patch is sufficient for
enough use cases already.

---

This PR re-implements #44532 but is based on the support added for macOS in #56599 with the following modifications to match Chromium's policy:

1. We also collect certificates from local machine, enterprise policies and trusted people
2. We check that the extended key usage (if it exists) is suitable for TLS use.

The first commit comes from #56832 to fix a leak from the macOS PR.

[nodejs-github-bot]

Review requested:

• @nodejs/crypto

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/64855/

[codecov]

Codecov Report

Attention: Patch coverage is 0% with 16 lines in your changes missing coverage. Please review.

Project coverage is 89.21%. Comparing base (304bb9c) to head (faf7592).
Report is 3 commits behind head on main.

Files with missing lines	Patch %	Lines
src/crypto/crypto_context.cc	0.00%	16 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #56833   +/-   ##
=======================================
  Coverage   89.20%   89.21%           
=======================================
  Files         663      663           
  Lines      192012   192028   +16     
  Branches    36929    36931    +2     
=======================================
+ Hits       171286   171319   +33     
- Misses      13582    13595   +13     
+ Partials     7144     7114   -30     

Files with missing lines	Coverage Δ
src/crypto/crypto_context.cc	67.49% <0.00%> (-1.20%)	⬇️

... and 31 files with indirect coverage changes

[timja]

Nice work!

What sort of testing have you done on this? - I see the integration test added

I'll look to get someone on windows behind our ZScaler enterprise setup next week to test it.

(and potentially with https://github.com/timja/openjdk-intermediate-ca-reproducer both root -> leaf and root -> intermediate -> leaf, unless you've tested something similar)

[joyeecheung]

What sort of testing have you done on this? - I see the integration test added

So far only the test I modified in test-native-certs.mjs - basically the same as the macOS test, just running it first to see that it fails, then adding that certificate locally to Windows, run the test and see that it works, and removing that certificate. From what I can tell the real-world use cases I have only require the root CA certificates from either local machine or the current users to be trusted. I will try verifying it a bit on my end.