Error format of untrusted certificate errors should depend on OS

Go 1.18.1 started using MacOS' x509 verification APIs on Macs
rather than Go's own. The error messages are different.

Signed-off-by: Margo Crawford <margaretc@vmware.com>

internal/controller/authenticator/jwtcachefiller/jwtcachefiller_test.go

@@ -36,6 +36,7 @@ import (
 	"go.pinniped.dev/internal/controllerlib"
 	"go.pinniped.dev/internal/crypto/ptls"
 	"go.pinniped.dev/internal/mocks/mocktokenauthenticatorcloser"
+	"go.pinniped.dev/internal/testutil"
 	"go.pinniped.dev/internal/testutil/testlogger"
 	"go.pinniped.dev/internal/testutil/tlsserver"
 )
@@ -293,7 +294,7 @@ func TestController(t *testing.T) {
 					Spec: *missingTLSJWTAuthenticatorSpec,
 				},
 			},
-			wantErr: `failed to build jwt authenticator: could not initialize provider: Get "` + goodIssuer + `/.well-known/openid-configuration": x509: certificate signed by unknown authority`,
+			wantErr: `failed to build jwt authenticator: could not initialize provider: Get "` + goodIssuer + `/.well-known/openid-configuration": ` + testutil.X509UntrustedCertError("Acme Co"),
 		},
 		{
 			name:    "invalid jwt authenticator CA",

internal/testutil/x509_error.go

@@ -0,0 +1,19 @@
+// Copyright 2022 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package testutil
+
+import (
+	"fmt"
+	"runtime"
+)
+
+func X509UntrustedCertError(commonName string) string {
+	if runtime.GOOS == "darwin" {
+		// Golang use's macos' x509 verification APIs on darwin.
+		// This output slightly different error messages than golang's
+		// own x509 verification.
+		return fmt.Sprintf(`x509: “%s” certificate is not trusted`, commonName)
+	}
+	return `x509: certificate signed by unknown authority`
+}

internal/upstreamldap/upstreamldap_test.go

@@ -1905,7 +1905,7 @@ func TestRealTLSDialing(t *testing.T) {
 			caBundle:  nil,
 			connProto: TLS,
 			context:   context.Background(),
-			wantError: `LDAP Result Code 200 "Network Error": x509: certificate signed by unknown authority`,
+			wantError: fmt.Sprintf(`LDAP Result Code 200 "Network Error": %s`, testutil.X509UntrustedCertError("Acme Co")),
 		},
 		{
 			name: "cannot connect to host",