Azure IMDS Plugin: Attestation Failures Due to Incomplete CA Pattern Coverage

The Azure IMDS node attestor fails for VMs in certain Azure regions because it only validates one of three CA naming patterns Microsoft uses:

• Pattern 1: Microsoft Azure RSA TLS Issuing CA XX (validated)
• Pattern 2: Microsoft TLS G1 RSA CA OCSP XX (fails)
• Pattern 3: Microsoft TLS G2 RSA CA OCSP XX (fails)

VMs with Pattern 2/3 certificates fail validation despite having legitimate Microsoft-issued certificates. This causes unpredictable attestation failures across Azure regions.

Root cause: The plugin validates intermediate CA names via regex instead of following Azure's official guidance (https://learn.microsoft.com/en-us/azure/virtual-machines/instance-metadata-service?tabs=linux#signature-validation-guidance) to validate the certificate Subject Alternative Name (SAN).

Additional issue: Missing Microsoft TLS RSA Root G2 root certificates (both self-signed and cross-signed versions), causing failures for 3-level certificate chains.