feat(rust): read the client identity from a PKCS#12 bundle

[wkirschenmann]

Lets the client's mTLS identity come from a PKCS#12 bundle instead of a PEM certificate/key pair.
CertP12 names a certificate and its key bundled together, the form Windows and most certificate
authorities hand out, optionally protected by CertP12Password. It is an alternative to
CertPem/KeyPem, not an addition: setting both spellings is refused while the configuration is
read, as is a password naming no bundle.

How it works

The bundle is loaded through p12-keystore (pure Rust, so no OpenSSL joins the build) under
Pkcs12ImportPolicy::Strict, and its whole chain is kept leaf first, re-encoded into the DER
shapes the PEM pair already produces, so a server that trusts only the root can still build its
path and nothing past Identity sees two identity formats. Loading happens while the configuration
is read, like every other file-naming option, so a mistyped path fails where the error can name the
option rather than surfacing later as a refused handshake.

CertP12Password is a SecretString: redacted by Debug, zeroized on drop, and never echoed in
an error. It deserialises through a secret_text reader added to config_utils, naming no option
of its own. The proxy-options PR adds the same reader; whichever lands second drops its copy.

RawIdentity gains a Pkcs12 shape, first so it wins over the PEM one and ahead of Bare, which
requires nothing and so stays last. Every shape carries every identity option and differs only in
which it requires: that is what lets load see both spellings at once, and what keeps a PEM pair
readable next to a CertP12 that is present but empty. The generated schema spells the same
distinction, as an anyOf whose branches differ by required; tests/schema.rs pins both new
option names and the bundle branch, in place of the assertion that CertP12 is absent.

C# parity

Worth knowing before this merges: the C# client declares CertP12
(packages/csharp/ArmoniK.Api.Client/Options/GrpcClient.cs:62) but has no CertP12Password -
GrpcChannelFactory.cs:536 opens the file with new X509Certificate2(path), and no spelling of a
p12 password exists anywhere under packages/csharp/. So CertP12Password is a name only the Rust
client knows, and a password-protected bundle is not portable to C#. The alternative is to refuse
password-protected bundles instead, keeping the vocabularies identical; this PR takes the first
road and documents the divergence in armonik-transport/README.md.

Tests

13 new tests. The PKCS#12 material: a bundle round-tripping into the same identity a PEM pair
produces, a CA-signed chain keeping its intermediates leaf first, an unprotected bundle opening
without a password, a wrong password naming the path and not itself, an identity-less bundle, a
file that is not PKCS#12, a path that leads nowhere, and the CertP12 option reading the file it
names. The option rules: mutual exclusion in all three combinations, an orphan password not echoed,
empty options reading as unset, an empty CertP12 leaving the PEM pair alone, and a bundle path
that leads nowhere failing while the configuration is read. Fixtures are generated with rcgen
rather than committed, so nothing can expire, and because p12-keystore rebuilds a bundle's chain
by issuer, proving the intermediates survive needs material that really signed the leaf.

Gates

From packages/rust, all green:

cargo test -p armonik-transport --all-features                  69 + 13 + 5 + 6 passed
cargo clippy -p armonik-transport --all-features --all-targets  0 warnings
cargo clippy -p armonik --all-features --all-targets            0 warnings
cargo check -p armonik-transport --no-default-features          0 warnings
cargo fmt --check                                               clean
cargo run -p armonik-transport --features schema --example generate_schema

[github-actions]

☂️ Python Coverage

current status: ✅

Overall Coverage

Lines	Covered	Coverage	Threshold	Status
1478	1247	84%	0%	🟢

New Files

No new covered files...

Modified Files

No covered modified files...

updated for commit: 3ea509e by action🐍

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud