Certificate pinning matches against all pins instead of hostname-scoped pins

[HighOverseer]

Description

In Darwin's CertificatePinner (ktor-client/ktor-client-darwin/darwin/src/io/ktor/client/engine/darwin/certificates/CertificatePinner.kt), findMatchingPins(hostname) is computed but not used for pins validation.

hasOnePinnedCertificate matches the server certificate chain against all configured pins, not just the pins that match the current hostname.

// applyPinning()
val matchingPins = findMatchingPins(hostname)
...
hasOnePinnedCertificate(certificates) // uses all pins

// hasOnePinnedCertificate()
pinnedCertificates.any { pin -> ... }

Impact

When multiple domains are pinned, a pin for domain A can satisfy pinning for domain B, breaking hostname-scoped pin isolation.

Expected

Certificate validation should only consider matchingPins.

Suggested Fix

Pass matchingPins into hasOnePinnedCertificate and validate against that set instead of pinnedCertificates.