macOS: Support intermediate certificates

[timja]

Fixes #3

This works now, remaining before ready for review:

• Change test to not be specific to my machine
• Try change to SSL policy from basic x509
• Review CF objects to ensure they are being correctly released

[shalupov]

current state: I was able to call SecItemCopyMatching without errors and it even returns something. See ef3ec66

Basically, two things:

• kCFBooleanFalse/True are not CFString, they're CFBoolean. Those unique constants could not be easily created, so I've imported them from framework symbols
• For some reason, SecItemCopyMatching do not accepted constants created via new strings, so I've also imported them from symbols

Could you please continue on PR and I'll try to help with JNA when required?

[timja]

Thanks for the help, its working now, I'll take a look at tests and any refactoring needed later

[shalupov]

Could you please add a WARN message that certificated is not trusted thus not imported

[timja]

Its valid for a certificate to be not trusted, its logged elsewhere:

LOGGER.fine("Certificate '" + certificateDescription + "' has no trust settings and failed to validate against trusted roots");

[shalupov]

From failing tests, looks like system certificates are not imported

[timja]

From failing tests, looks like system certificates are not imported

Right (annoying github action not trusting me -.-)

From stackoverflow:
https://stackoverflow.com/a/35095195

OpenJDK took the above approach:
https://github.com/openjdk/jdk/blob/master/src/java.base/macosx/native/libosxsecurity/KeystoreImpl.m#L525-L527

Although SecKeychainOpen is deprecated.

This looks like the supported way to do it though:
https://developer.apple.com/documentation/security/sectrustcopyanchorcertificates(_:)?language=objc

I'll give SecTrustCopyAnchorCertificates a go.

[timja]

I implemented SecTrustCopyAnchorCertificates but it contains non system certificates which is why openjdk went the other route.

I've implemented it using the key chain file system APIs. deprecated but still seems to be the recommended approach if you need to do this.

[shalupov]

squashed and pushed manually 477763d

[shalupov]

also added more checks: 96702ad