Add the ability to delay the receipt of a certificate in the extension method DataProtectionBuilderExtensions.ProtectKeysWithCertificate

### Problem
In my current project, we have several certificate providers, so we use the certificate factory. Also, we use data protection and protect keys with a certificate. The problem is that `DataProtectionBuilderExtensions.ProtectKeysWithCertificate` requires a certificate directly, for which we need a certificate factory, but for getting a factory, we need an `IServiceProvider`.

### Solution
We need to add a method overload with the following parameters.

``` C#
public static IDataProtectionBuilder ProtectKeysWithCertificate(this IDataProtectionBuilder builder, Func factory){...}
```

### Similar existing solutions
A similar solution already exists for `AddKeyEscrowSink`, but not for `ProtectKeysWithCertificate`.
``` C#
public static IDataProtectionBuilder AddKeyEscrowSink(this IDataProtectionBuilder builder, Func factory){...}
```

Start at DataProtectionBuilderExtensions.ProtectKeysWithCertificate and compare its current certificate handling with the existing AddKeyEscrowSink factory overload. Add the requested IServiceProvider-based overload so certificate receipt can be delayed; done means callers can supply Func alongside the existing API.

Written by the indexing model from the issue text.