Add TPM 2.0 support for Windows CAPI certificate installations

[sabixx]

Summary

• Add TPM 2.0 hardware-backed private key support for Windows CAPI installations
• Private keys are generated and stored in the TPM chip, making them non-exportable
• Certificates with TPM-backed keys work with Windows applications (IIS, SQL Server, etc.)

Features

• New CSR origins: tpm (mandatory) and tpm_optional (fallback to software if TPM unavailable)
• RSA keys supported (2048 bits guaranteed; larger sizes depend on TPM hardware, with optional legacyKeySize fallback)
• ECDSA P-256 and P-384 curves supported
• FriendlyName support for certificate lookup during renewal checks

Configuration Example

certificateTasks:
  - name: TPM Certificate
    request:
      csr: tpm              # or tpm_optional
      keyType: RSA
      keySize: 2048
      subject:
        commonName: server.example.com
      zone: 'vcert\Default'
      tpmConfig:
        legacyKeySize: false  # Set true to auto-fallback to 2048 if TPM doesn't support larger sizes
    installations:
      - format: CAPI
        capiLocation: LocalMachine\My
        capiFriendlyName: "TPM-Protected Certificate"

Constraints

• Windows only (CAPI installation format required)
• PKCS12/JKS/PEM installations not supported with TPM (keys cannot be exported)
• ED25519 not supported by TPM 2.0

Test plan

• Test csr: tpm with CAPI installation on Windows with TPM 2.0
• Test csr: tpm_optional fallback on Windows without TPM
• Test renewal respects renewBefore setting (FriendlyName lookup)
• Verify error messages for unsupported configurations (PEM, PKCS12, JKS)
• Test RSA 2048 and ECDSA P-256 key generation