fix(signature): return 422 for certificate validation failures

Differentiate certificate validation errors from missing-signature-password flow.\n\nUse HTTP 422 for revoked, invalid, expired, and unverifiable revocation status cases to avoid incorrect UI actions.

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

Author: vitormattos

lib/Service/IdentifyMethod/SignatureMethod/Password.php

@@ -63,19 +63,19 @@ private function validateCertificateRevocation(array $certificateData): void {
 		// fail-closed – we cannot confirm the certificate is not revoked.
 		throw new LibresignException(
 			$this->identifyService->getL10n()->t('Certificate revocation status could not be verified'),
-			400
+			422
 		);
 	}
 
 	private function validateCertificateExpiration(array $certificateData): void {
 		if (array_key_exists('validTo_time_t', $certificateData)) {
 			$validTo = $certificateData['validTo_time_t'];
 			if (!is_int($validTo)) {
-				throw new LibresignException($this->identifyService->getL10n()->t('Invalid certificate'), 400);
+				throw new LibresignException($this->identifyService->getL10n()->t('Invalid certificate'), 422);
 			}
 			$now = (new \DateTime())->getTimestamp();
 			if ($validTo <= $now) {
-				throw new LibresignException($this->identifyService->getL10n()->t('Certificate has expired'), 400);
+				throw new LibresignException($this->identifyService->getL10n()->t('Certificate has expired'), 422);
 			}
 		}
 	}