Stabilize ML-KEM X.509 certificates

[vcsjones]

ML-KEM X.509 was recently published as RFC 9935.

We should

• Verify that there are no changes we need to react to compared to the drafts that were used for implementation
• Update test vectors to use the latest if they differ from the draft
• Remove the SYSLIB5006 diagnostic where applicable
• Update any links from draft specifications to the final one

[dotnet-policy-service]

Tagging subscribers to this area: @bartonjs, @vcsjones, @dotnet/area-system-security
See info in area-owners.md if you want to be subscribed.

[bartonjs]

I don't think we did this yet for ML-DSA, either, which is/was RFC 9881 (or SLH-DSA, 9909)