[SECURITY] Fix CodeQL SM02196: suppress weak-hash warnings in negative test

[NN2000X]

Issue

Two CodeQL SM02196 ("Weak cryptography", SDL sdl-required, important severity) findings flag the same line in CoseIndirectSignature.Tests/CoseHashEnvelopeTests.cs:145:

using HashAlgorithm legacyHasher = hashSuffix == "md5" ? MD5.Create() : SHA1.Create();

• SM02196 #1 — SHA1.Create() (col 81-94)
• SM02196 #2 — MD5.Create() (col 66-78)

Why suppression, not replacement

The test is named SignatureMatchesRejectsLegacyDigestAlgorithms and is parameterized on [TestCase("md5")] [TestCase("sha1")]. Its explicit purpose is to verify the library rejects MD5 and SHA1 as payload digest algorithms. Replacing them with SHA2 would defeat the test entirely — SignatureMatches would return true instead of false and the assertion would invert.

Change

One line, suppression-only:

- using HashAlgorithm legacyHasher = hashSuffix == "md5" ? MD5.Create() : SHA1.Create();
+ using HashAlgorithm legacyHasher = hashSuffix == "md5" ? MD5.Create() : SHA1.Create(); // CodeQL [SM02196] Negative test: MD5/SHA1 are intentional inputs verifying the library rejects legacy digest algorithms.

The trailing // CodeQL [SM02196] ... format matches the repo's existing convention (see CoseSignTool/SignCommand.cs:1265 and L1307).

Validation

• No behavioural change — comment-only edit.
• Subsequent CodeQL scan should clear both SM02196 findings on this line.

Documentation

• Microsoft.Security.Cryptography.10004 — Weak hash algorithms banned
• CodeQL cs/weak-crypto