fix: extract PEM directly from legacy PFX fallback

[vitormattos]

Summary

• fix legacy PKCS#12 fallback used during DPS signing
• extract PEM key/certificate with OpenSSL CLI instead of retrying PEM as PKCS#12
• add unit coverage for PEM extraction from CLI output

Why

Legacy Brazilian A1 certificates can fail on OpenSSL 3 native PKCS#12 import with .
The CLI fallback already worked, but the code treated its PEM output as if it were still a PKCS#12 blob, causing emission to fail.

Validation

• DpsSigner unit test file passed via module autoload bootstrap
• module PHPUnit suite passed
• real signing smoke test passed with the same stored certificate that was failing in emission