MS Store cert pinning updates (1.11) (#5735)

Cherry-pick #5732 to 1.11

## Change
New certificate pinning guidelines/PKI allow us to pin only a trusted
intermediate. This means less churn due to renewals with the Store.

Adds functionality to the pinning validation to allow partial chain
definitions. This is leveraged to allow chains containing two new
intermediate certificates

The existing chains are left as is since they continue to be the current
in-operation values.

## Validation
Adds new tests covering partial chain definitions, etc.
Adds a new test to warn about the remaining lifetime of pinning
certificates.

Fix two unrelated version issues (#5719)

Fixes #4928
Fixes providing "1" for the version when the version is actually "1.0"
and the like (there is probably an issue filed but I didn't find it
after a quick search).

## Issues
Due to SQLite helpfully not being picky about data types, the packages
table in the v2 index was using INT64 for every column, when in reality
they should mostly by strings (TEXT). When the version was parsable as a
number, it would drop unnecessary portions (trailing 0s).

New code in the v2 index and the composite package changes were using
string comparison instead of `Version`, requiring an exact string match
rather than `Version` equality.

## Changes
Use the data type that we already had set up rather than always INT64.
This will require a service update to actually fix anything (but doesn't
require a client update).

Use `Version` comparisons rather than string in the v2 index and
composite package version selection.

Shorter default installer log filename (#5705)

## Change
Make `OutputTimePoint` more flexible by allowing arbitrary fields and
behaviors to be requested via flags.

Shorten the default installer log filename by removing the leading
`WinGet-` and dropping the milliseconds. Some installers use the log
file path as a base with no error handling to ensure a valid path is
produced. Anything we can remove means more likely success.

Shorter default installer log filename (#5705)

## Change
Make `OutputTimePoint` more flexible by allowing arbitrary fields and
behaviors to be requested via flags.

Shorten the default installer log filename by removing the leading
`WinGet-` and dropping the milliseconds. Some installers use the log
file path as a base with no error handling to ensure a valid path is
produced. Anything we can remove means more likely success.

Fix conflict with issue forms (#5663)

<!-- To check a checkbox place an "x" between the brackets. e.g: [x] -->

- [x] I have signed the [Contributor License
Agreement](https://cla.opensource.microsoft.com/microsoft/winget-pkgs).
- [ ] I have updated the [Release Notes](../doc/ReleaseNotes.md).
  - Not Applicable
- [ ] This pull request is related to an issue.

-----

@mdanish-kh @denelon
###### Microsoft Reviewers: [Open in
CodeFlow](https://microsoft.github.io/open-pr/?codeflow=https://github.com/microsoft/winget-cli/pull/5663)

Update release notes for BOM Handling (#5622)

[1.11] Add more missing flags for vcpkg (#5593)

Same as #5592, but on the release branch
###### Microsoft Reviewers: [Open in
CodeFlow](https://microsoft.github.io/open-pr/?codeflow=https://github.com/microsoft/winget-cli/pull/5593)

Swap WinForm for native window proc (#5530)

## Issue
The recent addition of a hidden WinForm pulled in a number of binaries
that in total were over 30 MB. This is overkill for what we needed.

## Change
Replace that hidden WinForm with a native window proc handler.

Apply latest loc patch (#5507)

###### Microsoft Reviewers: [Open in
CodeFlow](https://microsoft.github.io/open-pr/?codeflow=https://github.com/microsoft/winget-cli/pull/5507)

Add ReleaseStatic configuration to WinGetServer project (#5477)

Each vcpkg port can only be installed with a single triplet at a time
(in a given install directory). Since we have different triplets for
static and non-static configurations, we need to ensure that all
projects use the same triplet for a given solution configuration.

This PR adds the ReleaseStatic configuration to the WinGetServer project
and sets the solution to use that when appropriate. It also includes a
bit of deduplication in the vcxproj.

Having WinGetServer use the triplet for the non-static configuration
when building for static, is causing errors in the internal build
because it deletes some of the installed triplets that other projects
later try to consume.
###### Microsoft Reviewers: [Open in
CodeFlow](https://microsoft.github.io/open-pr/?codeflow=https://github.com/microsoft/winget-cli/pull/5477)