[jadamcrain]

Updates pkcs8 to 0.11 and bumps the crate version to 0.4.2. Publishing 0.4.2 is a separate step: pushing the 0.4.2 tag after this merges runs the release workflow.

Why: pkcs8 0.10 pulls in digest 0.10 and block-buffer 0.10.4, which OSV-Scanner flags for GHSA-qwgh-2vcv-g2f7 (fixed in 0.12.1). That fails the required osv-scanner check in rodbus and dnp3, which currently ignore it (stepfunc/rodbus#354, stepfunc/dnp3#850). With pkcs8 0.11 the dependency tree has only digest 0.11 and block-buffer 0.12.1. Earlier versions aren't affected: the advisory's inline cursor doesn't exist in 0.10, and the crate uses it only to decrypt a password-protected private key file.

Changes

• pkcs8 0.11. EncryptedPrivateKeyInfo is now generic, so encrypted keys are parsed with its borrowed form, EncryptedPrivateKeyInfoRef. pkcs8 types aren't part of the public API, so this is a patch release.
• A test for a key encrypted with PBES2, PBKDF2 (HMAC-SHA256) and AES-256-CBC, OpenSSL's default. The existing encrypted test key uses scrypt. The new test was added first and passes on both pkcs8 0.10 and 0.11.
• MSRV stays 1.85. The newest versions of some new dependencies need a later compiler (aes 0.9.3: 1.89, sha2 0.11.1: 1.88, ctutils 0.4.6: 1.87), but earlier versions support 1.85 (aes 0.9.2, sha2 0.11.0, ctutils 0.4.2). The msrv job has no lockfile, so it now resolves with CARGO_RESOLVER_INCOMPATIBLE_RUST_VERSIONS=fallback. Raising the MSRV to 1.89 would have broken dnp3, whose rust-version is 1.88.

Checked locally

• fmt; clippy and tests for sfio-rustls-config and the tests crate with crypto-ring and crypto-aws-lc
• Rust 1.85 with the fallback resolver: check with both providers, and tests with crypto-ring
• rodbus built against this branch via [patch.crates-io]: only block-buffer 0.12.1 remains, its 39 TLS tests pass, the tls-aws-lc build works, and it checks on its MSRV, 1.94