Currently the certificate is enrolled for the user, under which the service is running.

The certificate should be enrolled for the user, who is acting in privacyIDEA (or to whom in privacyIDEA this token is assigned - this is the subject in the request)

The Authentication between privacyIDEA (the client) and the MS CA Service should be done via (Client)-Certificates.

Add revoking certs functionality.
Can be done using ICertAdmin:
https://learn.microsoft.com/en-us/windows/win32/api/certadm/nf-certadm-icertadmin-revokecertificate

Add WiXSetup to install this project as a service and configure the required settings.

Update installer to wix toolset v4

It is probably preferred to have the enrollment agent cert used by the service to be in the users store.
ISignerCertificate::Initialize has a bool parameter to switch between machine and user context. So we could also make this configurable.
However, from experience the user that installs and therefore runs the service would create the enrollment agent certificate while doing so in the users store.

Get gRPC trace and log it to the logfile.

This allows to use the environment variables of gRPC tracing.
The logging output has to be redirected to our logfile.