Cherry pick #5601

## Change
Starting with the time that the UndockedRegFreeWinRT change was
introduced and working backward through commits, I found the equivalent
one (only whitespace changes are present, probably due to
auto-formatting). This change uses the existing overlay infrastructure
to update the detours port to that commit.

CP from #5680 

Ported changes backward from the termination handling refactor.

Cherry-pick #5732 to 1.11

## Change
New certificate pinning guidelines/PKI allow us to pin only a trusted
intermediate. This means less churn due to renewals with the Store.

Adds functionality to the pinning validation to allow partial chain
definitions. This is leveraged to allow chains containing two new
intermediate certificates

The existing chains are left as is since they continue to be the current
in-operation values.

## Validation
Adds new tests covering partial chain definitions, etc.
Adds a new test to warn about the remaining lifetime of pinning
certificates.