- now that CertOpenStore is correct for system stores, simplify
  CertOpenSystemStore
- correct CertDuplicateCertificateStore, with a test