fix(certificates)!: disclose undecoded unsigned attributes (#7920)

* fix(certificates): disclose undecoded unsigned attributes

* test(certificates): use parser-owned limitation text

src/application/binaryDiagnostics/PeCertificatesService.test.ts

@@ -128,6 +128,14 @@ it.each([
       value.entries[0]!.pkcs7!.certificates[0]!.location.offset = 0;
     },
   ],
+  [
+    "complete coverage with undecoded unsigned attributes",
+    (value: PeCertificates) => {
+      value.entries[0]!.pkcs7!.signers[0]!.unsigned_attribute_oids = [
+        "1.3.6.1.4.1.311.3.3.1",
+      ];
+    },
+  ],
 ] as const)(
   "rejects %s before creating observed Evidence",
   async (_label, mutate) => {

src/application/binaryDiagnostics/PeCertificatesService.ts

@@ -107,6 +107,15 @@ const validReport = (
       )
   )
     return false;
+  if (
+    report.coverage.status === "complete" &&
+    report.entries.some((entry) =>
+      entry.pkcs7?.signers.some((signer) =>
+        Array.isArray(signer.unsigned_attribute_oids),
+      ),
+    )
+  )
+    return false;
   if (report.table === null) return report.entries.length === 0;
   if (
     !inside(report.table.location) ||