credential-process selects cert with latest expiry if cert-selector matches multiple certs

[swansonaj]

According to current documentation: "... if more than one certificate matches the --cert-selector parameter within the OS-specific secure store, the credential-process command will fail.". Instead of failing I suggest the credential-process select the cert with the latest expiration date if the cert-selector matches multiple certs in the OS secure store. This could come in handy, for example, when certs are automatically rotated/updated causing multiple matching certs to exist in the secure store for some time period. With the right cert-selector and this modified behavior of the credential-process the cert-selector would not have to be modified to start using the new cert.