SignedCms: Match SignerInfo content-type to SignedData.encapContentInfo.eContentType

From https://datatracker.ietf.org/doc/html/rfc5652#section-5.6 (5.6. Signature Verification Process)

```
If the SignedData signerInfo includes signedAttributes, then the
content-type attribute value MUST match the SignedData
encapContentInfo eContentType value.
```

So, this is an RFC MUST that isn't being followed. Historically, we didn't verify it (explicitly... because of .NET Framework compat), but we've received complaints that we're missing this check, so we should add it.

https://github.com/dotnet/runtime/blob/cdc5b6220b7ad6a0fce09fed36aa6d6275f629ce/src/libraries/System.Security.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/SignerInfo.cs#L634

Start at SignerInfo.cs around line 634 and compare the existing SignedCms verification flow with RFC 5652 section 5.6. Trace how signedAttributes content-type and encapContentInfo eContentType are available, then verify that mismatched values are rejected while preserving the stated .NET Framework compatibility context.

Written by the indexing model from the issue text.