Add `Func<IServiceProvider, IEnumerable<X509Certificate2>>` overload for `UnprotectKeysWithAnyCertificate`

## Background and Motivation

The current [`UnprotectKeysWithAnyCertificate`](https://github.com/dotnet/aspnetcore/blob/bd9f3b786dce01a30203e4e207e7809bdc3da91a/src/DataProtection/DataProtection/src/DataProtectionBuilderExtensions.cs#L274) method takes an array of certificates that need to be resolved during startup without any services. Under the hood though it just uses the options pattern and only actually adds those certificates once the unprotect certificates are needed for the first time.

## Proposed API

```diff
namespace Microsoft.AspNetCore.DataProtection;

public static partial class DataProtectionBuilderExtensions
{
+ public static IDataProtectionBuilder UnprotectKeysWithAnyCertificate(this IDataProtectionBuilder builder, Func> certificateFactory);
}
```

## Usage Examples

```csharp
services.UnProtectKeysWithAnyCertificate(provider =>
{
var retriever = provider.GetRequiredService();
return retriever.Retrieve();
});
```

My own service can include logging, configuration, and retry logic all in a more testable location.

## Alternative Designs

[`XmlKeyDecryptionOptions`](https://github.com/dotnet/aspnetcore/blob/bd9f3b786dce01a30203e4e207e7809bdc3da91a/src/DataProtection/DataProtection/src/XmlEncryption/XmlKeyDecryptionOptions.cs#L14) could be made public so that I can implement this using the options pattern myself.

## Risks

The new overload should have no resolution issues with the current one, can't think of any other dangers.

## Aside

This method should likely have a null check on the argument so it would throw that instead of a NullReferenceException when `Thumbprint` is accessed on it.

https://github.com/dotnet/aspnetcore/blob/bd9f3b786dce01a30203e4e207e7809bdc3da91a/src/DataProtection/DataProtection/src/XmlEncryption/XmlKeyDecryptionOptions.cs#L28