[release/10.0] Release Android X509 chain certificate GREFs (#128385)

Backport of #128284 to release/10.0

/cc @simonrozsival

## Customer Impact

- [x] Customer reported
- [ ] Found internally

A customer reported that their app was crashing due to a memory leak in
X509Chain class (JNI global ref table overflow).

## Regression

- [ ] Yes
- [x] No

[If yes, specify when the regression was introduced. Provide the PR or
commit if known.]

## Testing

The new unit test
(ChainTests.BuildChainRepeatedly_DoesNotExhaustGlobalReferences) passes
locally on Android emulator.

## Risk

Low. The change only affects Android and the code path is well covered
by tests.

**IMPORTANT**: If this backport is for a servicing release, please
verify that:

- For .NET 8 and .NET 9: The PR target branch is `release/X.0-staging`,
not `release/X.0`.
- For .NET 10+: The PR target branch is `release/X.0` (no `-staging`
suffix).

## Package authoring no longer needed in .NET 9

**IMPORTANT**: Starting with .NET 9, you no longer need to edit a NuGet
package's csproj to enable building and bump the version.
Keep in mind that we still need package authoring in .NET 8 and older
versions.

---------

Co-authored-by: Simon Rozsival <simon@rozsival.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: 3 people

src/libraries/Common/src/Interop/Android/System.Security.Cryptography.Native.Android/Interop.X509Chain.cs

@@ -42,15 +42,33 @@ internal static X509Certificate2[] X509ChainGetCertificates(SafeX509ChainContext
             var certPtrs = new IntPtr[count];
 
             int res = Interop.AndroidCrypto.X509ChainGetCertificates(ctx, certPtrs, certPtrs.Length);
-            if (res == 0)
-                throw new CryptographicException();
-
-            Debug.Assert(res <= certPtrs.Length);
 
             var certs = new X509Certificate2[certPtrs.Length];
-            for (int i = 0; i < res; i++)
+            try
+            {
+                if (res == 0)
+                    throw new CryptographicException();
+
+                Debug.Assert(res <= certPtrs.Length);
+
+                for (int i = 0; i < res; i++)
+                {
+                    // X509Certificate2 duplicates these JNI global refs; the native-returned refs remain caller-owned.
+                    certs[i] = new X509Certificate2(certPtrs[i]);
+                }
+            }
+            finally
             {
-                certs[i] = new X509Certificate2(certPtrs[i]);
+                // The native side can populate part of certPtrs and then fail (returning 0) if a JNI
+                // exception is thrown mid-loop, so release every non-null entry rather than only the
+                // first `res` entries.
+                for (int i = 0; i < certPtrs.Length; i++)
+                {
+                    if (certPtrs[i] != IntPtr.Zero)
+                    {
+                        Interop.JObjectLifetime.DeleteGlobalReference(certPtrs[i]);
+                    }
+                }
             }
 
             if (res == certPtrs.Length)